Katalog CVE (hal. 293)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.986 (Critical 36.028 · High 103.893 · KEV 1.748 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 14.601–14.650 dari 259.986 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-87836 The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned...	2.7 Low	—	0,32%	17 Sep 2026
CVE-2026-87786 The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthe...	8.8 High	—	0,51%	17 Sep 2026
CVE-2026-86824 The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash,...	4.8 Medium	—	0,15%	17 Sep 2026
CVE-2026-86788 The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and bloc...	6.8 Medium	—	0,43%	17 Sep 2026
CVE-2026-86710 The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, wh...	9.8 Critical	—	0,50%	17 Sep 2026
CVE-2026-86709 The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log i...	9.8 Critical	—	0,63%	17 Sep 2026
CVE-2026-86707 The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata val...	9.8 Critical	—	0,50%	17 Sep 2026
CVE-2026-86446 The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obta...	3.7 Low	—	0,28%	17 Sep 2026
CVE-2026-85130 The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an...	8.8 High	—	0,51%	17 Sep 2026
CVE-2026-85128 The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer,...	7.5 High	—	0,32%	17 Sep 2026
CVE-2025-15697 The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthe...	7.1 High	—	0,16%	17 Sep 2026
CVE-2026-87935 The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is...	8.1 High	—	0,91%	17 Sep 2026
CVE-2026-87796 The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. T...	9.8 Critical	—	1,1%	17 Sep 2026
CVE-2026-50604 A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require...	4.9 Medium	—	0,21%	17 Sep 2026
CVE-2026-25294 qualcomm cologne firmware, qualcomm congo firmware +58 lainnya Transient DOS while parsing frame during channel usage.	7.4 High	—	0,10%	17 Sep 2026
CVE-2026-25290 qualcomm cologne firmware, qualcomm fastconnect 7800 firmware +5 lainnya Memory Corruption when validating large data buffers from external sources using addition to check buffer length.	7.8 High	—	0,07%	17 Sep 2026
CVE-2026-25284 qualcomm cologne firmware, qualcomm fastconnect 7800 firmware +5 lainnya Information Disclosure when a pointer is reused after being deallocated.	7.3 High	—	0,07%	17 Sep 2026
CVE-2026-25283 qualcomm cologne firmware, qualcomm fastconnect 7800 firmware +5 lainnya Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.	8.8 High	—	0,07%	17 Sep 2026
CVE-2026-25282 qualcomm cologne firmware, qualcomm fastconnect 7800 firmware +5 lainnya Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.	7.9 High	—	0,06%	17 Sep 2026
CVE-2026-25281 qualcomm cologne firmware, qualcomm fastconnect 7800 firmware +5 lainnya Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.	7.4 High	—	0,10%	17 Sep 2026
CVE-2026-25280 qualcomm wsa8845h firmware, qualcomm cologne firmware +18 lainnya Memory corruption when processing escape handling flow with insufficient user buffer sizes.	7.8 High	—	0,07%	17 Sep 2026
CVE-2026-25278 qualcomm lemans au lgit firmware, qualcomm lemansau firmware +27 lainnya Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.	7.0 High	—	0,05%	17 Sep 2026
CVE-2026-25275 qualcomm q-7790 firmware, qualcomm qam8255p firmware +58 lainnya Transient DOS when processing authentication frames with invalid FILS information element header lengths.	7.5 High	—	0,19%	17 Sep 2026
CVE-2026-25261 qualcomm cologne firmware, qualcomm fastconnect 6700 firmware +22 lainnya Memory corruption while processing rear sensor IOCTL calls.	7.8 High	—	0,07%	17 Sep 2026
CVE-2026-24081 qualcomm ar8035 firmware, qualcomm c110100 firmware +58 lainnya Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.	7.4 High	—	0,10%	17 Sep 2026
CVE-2026-24075 qualcomm wsa8845h firmware, qualcomm aqt1000 firmware +41 lainnya Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.	7.0 High	—	0,06%	17 Sep 2026
CVE-2026-24074 qualcomm iqx5121 firmware, qualcomm iqx7181 firmware +23 lainnya Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.	7.8 High	—	0,07%	17 Sep 2026
CVE-2026-24073 qualcomm cologne firmware, qualcomm fastconnect 6900 firmware +12 lainnya Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.	7.8 High	—	0,07%	17 Sep 2026
CVE-2025-59607 qualcomm cologne firmware, qualcomm fastconnect 6900 firmware +12 lainnya Memory Corruption when copying large input data exceeds normal allocation limits.	7.8 High	—	0,07%	17 Sep 2026
CVE-2026-92839 Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under th...	4.3 Medium	—	0,28%	17 Sep 2026
CVE-2026-86311 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions...	6.4 Medium	—	0,26%	17 Sep 2026
CVE-2026-50603 A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded...	4.9 Medium	—	0,10%	17 Sep 2026
CVE-2026-89064 The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to th...	5.3 Medium	—	0,50%	17 Sep 2026
CVE-2026-92838 A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe...	7.8 High	—	0,20%	17 Sep 2026
CVE-2026-81546 The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading to a stack-b...	7.7 High	—	0,15%	17 Sep 2026
CVE-2026-65388 A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry...	7.5 High	—	0,43%	16 Sep 2026
CVE-2026-61599 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves t...	8.8 High	—	0,60%	16 Sep 2026
CVE-2026-61596 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization (`...	7.1 High	—	0,33%	16 Sep 2026
CVE-2026-61589 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `V...	6.3 Medium	—	0,18%	16 Sep 2026
CVE-2026-61588 djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` instance is a...	6.5 Medium	—	0,39%	16 Sep 2026
CVE-2026-92599 joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` va...	7.5 High	—	0,58%	16 Sep 2026
CVE-2026-92598 Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label...	6.5 Medium	—	0,40%	16 Sep 2026
CVE-2026-92597 Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character...	6.5 Medium	—	0,38%	16 Sep 2026
CVE-2026-92596 Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by suppl...	7.5 High	—	0,82%	16 Sep 2026
CVE-2026-92595 Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resol...	5.9 Medium	—	0,30%	16 Sep 2026
CVE-2026-92594 Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enf...	7.5 High	—	0,43%	16 Sep 2026
CVE-2026-92593 Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remain...	8.8 High	—	0,55%	16 Sep 2026
CVE-2026-92592 Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validat...	8.8 High	—	0,65%	16 Sep 2026
CVE-2026-92591 Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/v...	5.9 Medium	—	0,41%	16 Sep 2026
CVE-2026-92590 Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails...	5.4 Medium	—	0,24%	16 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.