Katalog CVE (hal. 502)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.273 (Critical 36.346 · High 105.264 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.051–25.100 dari 263.273 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-27086 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart:...	6.5 Medium	—	0,22%	4 Sep 2026
CVE-2026-13148 Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resource leak exposure. This issue affects smartLink HW-PN: from 1.04 before...	6.3 Medium	—	0,24%	4 Sep 2026
CVE-2026-85538 An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org...	8.3 High	—	0,41%	4 Sep 2026
CVE-2026-85533 An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced Sharing Grou...	7.6 High	—	0,37%	4 Sep 2026
CVE-2026-85528 Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to...	5.3 Medium	—	0,29%	4 Sep 2026
CVE-2026-85525 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses...	7.4 High	—	0,16%	4 Sep 2026
CVE-2026-85311 Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: f...	5.3 Medium	—	0,29%	4 Sep 2026
CVE-2026-81665 A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to r...	7.5 High	—	0,35%	4 Sep 2026
CVE-2026-81302 PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the af...	8.5 High	—	0,15%	4 Sep 2026
CVE-2026-57777 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affec...	7.6 High	—	0,40%	4 Sep 2026
CVE-2026-32480 Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Members...	5.3 Medium	—	0,29%	4 Sep 2026
CVE-2026-27432 Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. T...	5.4 Medium	—	0,31%	4 Sep 2026
CVE-2026-15937 Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate again...	5.3 Medium	—	0,14%	4 Sep 2026
CVE-2026-85229 UNSUPPORTED WHEN ASSIGNED Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI. Thi...	6.1 Medium	—	0,25%	4 Sep 2026
CVE-2026-85197 A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client impleme...	7.6 High	—	0,27%	4 Sep 2026
CVE-2026-80190 Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers. Th...	6.1 Medium	—	0,26%	4 Sep 2026
CVE-2026-6217 Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online Portal allows Cryptanalysis. This issue affects Pik Online Portal: th...	6.3 Medium	—	0,18%	4 Sep 2026
CVE-2026-85094 The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebV...	8.8 High	—	0,43%	4 Sep 2026
CVE-2026-85085 The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to c...	9.6 Critical	—	0,39%	4 Sep 2026
CVE-2026-84146 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product sum...	5.3 Medium	—	0,33%	4 Sep 2026
CVE-2026-84066 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modifie...	3.1 Low	—	0,21%	4 Sep 2026
CVE-2026-82194 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing admi...	5.5 Medium	—	0,34%	4 Sep 2026
CVE-2026-82193 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing admi...	5.5 Medium	—	0,38%	4 Sep 2026
CVE-2026-82186 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator...	4.1 Medium	—	0,69%	4 Sep 2026
CVE-2026-81347 The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing u...	5.9 Medium	—	0,38%	4 Sep 2026
CVE-2026-81270 Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0,...	7.5 High	—	0,43%	4 Sep 2026
CVE-2026-80438 The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific c...	5.9 Medium	—	0,23%	4 Sep 2026
CVE-2026-80181 Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade t...	9.1 Critical	—	0,46%	4 Sep 2026
CVE-2026-80180 Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0,...	6.1 Medium	—	0,26%	4 Sep 2026
CVE-2026-79632 The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recip...	5.3 Medium	—	0,30%	4 Sep 2026
CVE-2026-79631 The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing u...	5.3 Medium	—	0,35%	4 Sep 2026
CVE-2026-79630 The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured...	5.3 Medium	—	0,30%	4 Sep 2026
CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbit...	6.8 Medium	—	0,40%	4 Sep 2026
CVE-2026-71216 PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a re...	5.3 Medium	—	0,22%	4 Sep 2026
CVE-2026-70403 XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.	9.3 Critical	—	0,52%	4 Sep 2026
CVE-2026-69657 XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.	9.3 Critical	—	0,52%	4 Sep 2026
CVE-2026-66840 XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.	8.7 High	—	0,44%	4 Sep 2026
CVE-2026-62928 XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.	9.3 Critical	—	2,0%	4 Sep 2026
CVE-2026-19224 The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single si...	7.2 High	—	0,37%	4 Sep 2026
CVE-2026-17517 The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated att...	5.3 Medium	—	0,21%	4 Sep 2026
CVE-2026-16281 The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes...	7.1 High	—	0,19%	4 Sep 2026
CVE-2025-15691 The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relyi...	5.3 Medium	—	0,18%	4 Sep 2026
CVE-2026-85509 FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.	9.8 Critical	—	0,41%	4 Sep 2026
CVE-2026-85508 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to de...	9.8 Critical	—	0,41%	4 Sep 2026
CVE-2026-85507 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-sys...	9.8 Critical	—	0,41%	4 Sep 2026
CVE-2026-85506 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-sy...	9.8 Critical	—	0,41%	4 Sep 2026
CVE-2026-85505 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a sho...	7.5 High	—	0,35%	4 Sep 2026
CVE-2026-85504 FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via mal...	9.8 Critical	—	0,41%	4 Sep 2026
CVE-2026-85409 A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnai...	6.3 Medium	—	0,49%	4 Sep 2026
CVE-2026-85408 A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the compo...	4.3 Medium	—	0,40%	4 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.