Katalog CVE (hal. 440)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 262.902 (Critical 36.304 · High 105.051 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 23 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 21.951–22.000 dari 262.902 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-80440 The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it...	4.8 Medium	—	0,24%	9 Sep 2026
CVE-2026-83537 The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthen...	5.3 Medium	—	0,16%	9 Sep 2026
CVE-2026-87747 The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arb...	4.9 Medium	—	0,61%	9 Sep 2026
CVE-2026-85117 The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted,...	6.5 Medium	—	0,31%	9 Sep 2026
CVE-2026-19802 The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to...	4.3 Medium	—	0,43%	9 Sep 2026
CVE-2026-19855 The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any...	6.5 Medium	—	0,18%	9 Sep 2026
CVE-2025-7062 A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4....	5.2 Medium	—	0,30%	9 Sep 2026
CVE-2026-84908 The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load...	5.3 Medium	—	0,42%	9 Sep 2026
CVE-2026-85037 The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the...	5.3 Medium	—	0,30%	9 Sep 2026
CVE-2026-85132 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated u...	4.3 Medium	—	0,27%	9 Sep 2026
CVE-2026-85133 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated use...	5.4 Medium	—	0,23%	9 Sep 2026
CVE-2026-85418 The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name i...	5.4 Medium	—	0,23%	9 Sep 2026
CVE-2026-8615 The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verificati...	4.3 Medium	—	0,34%	9 Sep 2026
CVE-2026-84222 The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthen...	5.3 Medium	—	0,35%	9 Sep 2026
CVE-2026-84068 The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers...	8.6 High	—	0,45%	9 Sep 2026
CVE-2026-84113 The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as admi...	4.1 Medium	—	0,31%	9 Sep 2026
CVE-2026-83541 The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could...	6.8 Medium	—	0,43%	9 Sep 2026
CVE-2026-83593 The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter i...	7.2 High	—	0,53%	9 Sep 2026
CVE-2026-82848 The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthent...	5.3 Medium	—	0,32%	9 Sep 2026
CVE-2026-81022 The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing una...	5.3 Medium	—	0,35%	9 Sep 2026
CVE-2026-81741 The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow...	4.7 Medium	—	0,29%	9 Sep 2026
CVE-2026-82184 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs o...	5.3 Medium	—	0,16%	9 Sep 2026
CVE-2026-82185 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such...	4.3 Medium	—	0,25%	9 Sep 2026
CVE-2026-80339 The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outp...	5.3 Medium	—	0,35%	9 Sep 2026
CVE-2026-80340 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outp...	5.3 Medium	—	0,35%	9 Sep 2026
CVE-2026-80341 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any auth...	5.9 Medium	—	0,23%	9 Sep 2026
CVE-2026-81021 The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated a...	5.3 Medium	—	0,35%	9 Sep 2026
CVE-2026-75861 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authent...	6.5 Medium	—	0,30%	9 Sep 2026
CVE-2026-75905 The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verify...	4.3 Medium	—	0,37%	9 Sep 2026
CVE-2026-76009 The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconn...	8.1 High	—	0,90%	9 Sep 2026
CVE-2026-19946 The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the...	4.3 Medium	—	0,24%	9 Sep 2026
CVE-2026-16960 The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated user...	7.5 High	—	0,35%	9 Sep 2026
CVE-2026-18042 The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message hand...	5.3 Medium	—	0,22%	9 Sep 2026
CVE-2026-14962 The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthentica...	8.6 High	—	0,40%	9 Sep 2026
CVE-2026-13144 The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit h...	3.7 Low	—	0,19%	9 Sep 2026
CVE-2026-13146 The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unaut...	3.7 Low	—	0,19%	9 Sep 2026
CVE-2025-15690 The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allow...	6.8 Medium	—	0,28%	9 Sep 2026
CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalar multiplication: the time req...	5.9 Medium	—	0,33%	9 Sep 2026
CVE-2026-87732 An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write...	6.2 Medium	—	0,11%	9 Sep 2026
CVE-2026-87733 An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the p...	6.2 Medium	—	0,15%	9 Sep 2026
CVE-2026-87734 An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.	7.5 High	—	0,51%	9 Sep 2026
CVE-2026-87735 An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption...	4.3 Medium	—	0,23%	9 Sep 2026
CVE-2026-87736 An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.	4.3 Medium	—	0,36%	9 Sep 2026
CVE-2026-21106 Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection setting...	5.1 Medium	—	0,11%	9 Sep 2026
CVE-2026-21107 samsung notes Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory.	5.5 Medium	—	0,09%	9 Sep 2026
CVE-2026-21108 samsung bixby Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information.	5.5 Medium	—	0,09%	9 Sep 2026
CVE-2026-21109 Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information.	2.1 Low	—	0,11%	9 Sep 2026
CVE-2026-21110 Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code.	6.9 Medium	—	0,11%	9 Sep 2026
CVE-2026-21111 Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory.	6.9 Medium	—	0,10%	9 Sep 2026
CVE-2026-21112 samsung android Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is require...	5.5 Medium	—	0,09%	9 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.