Katalog CVE (hal. 480)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.109 (Critical 36.329 · High 105.151 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 24 Okt 2026, 12:30 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 23.951–24.000 dari 263.109 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73318 xenforo XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreem...	3.8 Low	—	0,49%	8 Sep 2026
CVE-2026-73319 xenforo XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript...	6.1 Medium	—	0,41%	8 Sep 2026
CVE-2026-73320 xenforo XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplyi...	6.1 Medium	—	0,36%	8 Sep 2026
CVE-2026-73321 xenforo XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by s...	6.5 Medium	—	0,61%	8 Sep 2026
CVE-2026-74239 xenforo XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with...	7.2 High	—	0,89%	8 Sep 2026
CVE-2026-73310 xenforo XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI bi...	5.9 Medium	—	0,49%	8 Sep 2026
CVE-2026-73311 xenforo XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used a...	7.4 High	—	0,50%	8 Sep 2026
CVE-2026-73312 xenforo XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens...	7.4 High	—	0,47%	8 Sep 2026
CVE-2026-73313 xenforo XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as a...	8.1 High	—	0,58%	8 Sep 2026
CVE-2026-73314 xenforo XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature v...	7.5 High	—	0,65%	8 Sep 2026
CVE-2026-73315 xenforo XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to...	8.6 High	—	0,36%	8 Sep 2026
CVE-2026-73316 xenforo XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times...	7.5 High	—	0,27%	8 Sep 2026
CVE-2026-73309 xenforo XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by su...	9.1 Critical	—	0,69%	8 Sep 2026
CVE-2026-33387 A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the require...	4.6 Medium	—	0,26%	8 Sep 2026
CVE-2026-33388 An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user wit...	7.4 High	—	0,41%	8 Sep 2026
CVE-2026-33389 An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices wit...	7.5 High	—	0,17%	8 Sep 2026
CVE-2026-33391 An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user w...	5.4 Medium	—	0,36%	8 Sep 2026
CVE-2026-33920 A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacke...	3.5 Low	—	0,14%	8 Sep 2026
CVE-2026-79602 A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.	8.8 High	—	0,13%	8 Sep 2026
CVE-2026-79603 x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Sinc...	4.3 Medium	—	0,22%	8 Sep 2026
CVE-2026-77103 commvault CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release....	7.5 High	—	0,50%	8 Sep 2026
CVE-2026-77104 commvault CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.	7.5 High	—	0,56%	8 Sep 2026
CVE-2026-77105 commvault CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommSe...	8.8 High	—	0,30%	8 Sep 2026
CVE-2026-77106 commvault Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commva...	8.8 High	—	0,58%	8 Sep 2026
CVE-2026-77089 commvault Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Cen...	9.8 Critical	—	0,61%	8 Sep 2026
CVE-2026-77091 commvault DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and...	7.8 High	—	0,18%	8 Sep 2026
CVE-2026-77092 commvault Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update C...	9.8 Critical	—	0,32%	8 Sep 2026
CVE-2026-77097 commvault Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolve...	8.2 High	—	0,47%	8 Sep 2026
CVE-2026-77098 commvault Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metr...	9.8 Critical	—	0,47%	8 Sep 2026
CVE-2026-77101 commvault CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.	7.5 High	—	0,46%	8 Sep 2026
CVE-2026-77102 commvault CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.	7.5 High	—	0,46%	8 Sep 2026
CVE-2026-75021 fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reacha...	8.1 High	—	0,71%	8 Sep 2026
CVE-2026-62437 When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of track...	6.5 Medium	—	0,10%	8 Sep 2026
CVE-2026-19203 A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, pot...	8.3 High	—	0,31%	8 Sep 2026
CVE-2026-11573 Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::sav...	7.1 High	—	0,39%	8 Sep 2026
CVE-2026-12611 A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole s...	8.7 High	—	0,25%	8 Sep 2026
CVE-2026-86713 PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the...	7.1 High	—	0,38%	8 Sep 2026
CVE-2026-86714 PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supp...	5.4 Medium	—	0,33%	8 Sep 2026
CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side...	7.4 High	—	0,22%	8 Sep 2026
CVE-2026-86712 SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled...	8.8 High	—	0,72%	8 Sep 2026
CVE-2026-76931 The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due...	6.4 Medium	—	0,33%	8 Sep 2026
CVE-2026-77968 A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a contro...	8.2 High	—	0,42%	8 Sep 2026
CVE-2026-78234 A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client ce...	9.9 Critical	—	0,39%	8 Sep 2026
CVE-2026-74860 A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Do...	8.5 High	—	0,45%	8 Sep 2026
CVE-2026-3174 The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return en...	7.5 High	—	0,47%	8 Sep 2026
CVE-2026-2520 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on...	5.4 Medium	—	0,21%	8 Sep 2026
CVE-2026-17509 The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to...	6.5 Medium	—	0,23%	8 Sep 2026
CVE-2026-18021 The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includi...	6.5 Medium	—	0,27%	8 Sep 2026
CVE-2026-16502 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserializa...	8.8 High	—	0,45%	8 Sep 2026
CVE-2026-12230 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' par...	6.4 Medium	—	0,20%	8 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.