Katalog CVE (hal. 501)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.273 (Critical 36.346 · High 105.264 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.001–25.050 dari 263.273 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-85603 Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authentica...	6.5 Medium	—	0,63%	4 Sep 2026
CVE-2026-85602 The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present...	5.3 Medium	—	0,36%	4 Sep 2026
CVE-2026-85601 Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal...	5.4 Medium	—	0,28%	4 Sep 2026
CVE-2026-85600 Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), wh...	5.4 Medium	—	0,24%	4 Sep 2026
CVE-2026-85599 Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to ren...	7.2 High	—	0,26%	4 Sep 2026
CVE-2026-85598 Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attac...	6.4 Medium	—	0,26%	4 Sep 2026
CVE-2026-85597 traefik Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certifica...	9.1 Critical	—	0,35%	4 Sep 2026
CVE-2026-85596 traefik Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the...	9.8 Critical	—	0,44%	4 Sep 2026
CVE-2026-85595 traefik Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames r...	9.8 Critical	—	0,69%	4 Sep 2026
CVE-2026-85594 traefik Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kuber...	9.8 Critical	—	0,48%	4 Sep 2026
CVE-2026-85593 phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FA...	5.4 Medium	—	0,24%	4 Sep 2026
CVE-2026-85592 phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all ca...	3.7 Low	—	0,31%	4 Sep 2026
CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account...	7.1 High	—	0,52%	4 Sep 2026
CVE-2026-85590 phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig() handler (...	7.1 High	—	0,52%	4 Sep 2026
CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentica...	5.3 Medium	—	0,49%	4 Sep 2026
CVE-2026-85588 phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP...	5.3 Medium	—	0,53%	4 Sep 2026
CVE-2026-85587 phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with o...	5.3 Medium	—	0,36%	4 Sep 2026
CVE-2026-85586 phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAP...	6.9 Medium	—	0,49%	4 Sep 2026
CVE-2026-85585 SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request pa...	7.5 High	—	0,51%	4 Sep 2026
CVE-2026-85584 SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-control...	7.5 High	—	0,59%	4 Sep 2026
CVE-2026-85583 SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths...	6.5 Medium	—	0,64%	4 Sep 2026
CVE-2026-85582 SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust...	6.5 Medium	—	0,44%	4 Sep 2026
CVE-2026-85581 SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process id...	7.5 High	—	0,58%	4 Sep 2026
CVE-2026-85580 SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers c...	6.5 Medium	—	0,58%	4 Sep 2026
CVE-2026-85579 SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState endpoint. T...	4.3 Medium	—	0,28%	4 Sep 2026
CVE-2026-85578 SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly conf...	6.5 Medium	—	0,38%	4 Sep 2026
CVE-2026-85577 AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScr...	5.4 Medium	—	0,29%	4 Sep 2026
CVE-2026-19080 Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 202609032114...	7.5 High	—	0,30%	4 Sep 2026
CVE-2026-19051 Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before...	7.1 High	—	0,21%	4 Sep 2026
CVE-2026-19043 Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Menulux P...	4.3 Medium	—	0,20%	4 Sep 2026
CVE-2026-18957 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. This issue...	5.4 Medium	—	0,16%	4 Sep 2026
CVE-2026-85534 A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control w...	5.9 Medium	—	0,32%	4 Sep 2026
CVE-2026-85512 A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The m...	7.3 High	—	0,50%	4 Sep 2026
CVE-2026-84428 fastify fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the tra...	7.5 High	—	0,52%	4 Sep 2026
CVE-2026-84045 The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before p...	5.3 Medium	—	0,32%	4 Sep 2026
CVE-2026-79707 A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remot...	8.7 High	—	0,67%	4 Sep 2026
CVE-2026-4644 A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticat...	8.5 High	—	0,35%	4 Sep 2026
CVE-2026-27347 Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a...	5.3 Medium	—	0,31%	4 Sep 2026
CVE-2026-85547 A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identif...	6.2 Medium	—	0,36%	4 Sep 2026
CVE-2026-85546 MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions...	8.6 High	—	0,21%	4 Sep 2026
CVE-2026-85541 DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's brow...	5.4 Medium	—	0,28%	4 Sep 2026
CVE-2026-85540 DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database...	8.8 High	—	0,54%	4 Sep 2026
CVE-2026-85184 fastify/middie @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resol...	9.1 Critical	—	0,52%	4 Sep 2026
CVE-2026-84504 fastify fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request...	8.1 High	—	0,43%	4 Sep 2026
CVE-2026-84469 fastify fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid sch...	7.5 High	—	0,49%	4 Sep 2026
CVE-2026-84044 The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthe...	5.3 Medium	—	0,16%	4 Sep 2026
CVE-2026-84043 The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthentica...	5.3 Medium	—	0,16%	4 Sep 2026
CVE-2026-82923 The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers...	9.8 Critical	—	0,83%	4 Sep 2026
CVE-2026-81666 An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems...	6.5 Medium	—	0,19%	4 Sep 2026
CVE-2026-76169 fastify fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invo...	7.5 High	—	0,53%	4 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.