Katalog CVE (hal. 513)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.601–25.650 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-78600 elastic cloud on kubernetes Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist afte...	3.5 Low	—	0,28%	2 Sep 2026
CVE-2026-78599 elastic kibana Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal reso...	6.5 Medium	—	0,48%	2 Sep 2026
CVE-2026-78598 elastic kibana Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security...	5.4 Medium	—	0,24%	2 Sep 2026
CVE-2026-78594 elastic apm server Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user...	4.9 Medium	—	0,50%	2 Sep 2026
CVE-2026-78591 elastic kibana Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via...	6.3 Medium	—	0,36%	2 Sep 2026
CVE-2026-78590 elastic kibana Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged re...	7.3 High	—	0,41%	2 Sep 2026
CVE-2026-78588 elastic filebeat Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach...	6.5 Medium	—	0,42%	2 Sep 2026
CVE-2026-78587 elastic fleet server Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correc...	3.1 Low	—	0,30%	2 Sep 2026
CVE-2026-78586 elastic kibana Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with...	6.5 Medium	—	0,47%	2 Sep 2026
CVE-2026-78584 elastic kibana Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated u...	4.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-78153 The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing...	5.3 Medium	—	0,35%	2 Sep 2026
CVE-2026-77794 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, all...	5.3 Medium	—	0,32%	2 Sep 2026
CVE-2026-77793 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a p...	5.3 Medium	—	0,32%	2 Sep 2026
CVE-2026-77009 The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated use...	9.9 Critical	—	0,52%	2 Sep 2026
CVE-2026-4357 The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for...	10.0 Critical	—	0,55%	2 Sep 2026
CVE-2026-2811 The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data....	5.4 Medium	—	0,28%	2 Sep 2026
CVE-2026-2688 The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly chec...	6.5 Medium	—	0,36%	2 Sep 2026
CVE-2026-19698 The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end,...	3.5 Low	—	0,17%	2 Sep 2026
CVE-2026-17563 The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the...	5.3 Medium	—	0,22%	2 Sep 2026
CVE-2026-14326 The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff r...	3.8 Low	—	0,23%	2 Sep 2026
CVE-2026-14255 A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vu...	5.5 Medium	—	0,11%	2 Sep 2026
CVE-2026-10821 The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration fil...	6.6 Medium	—	0,51%	2 Sep 2026
CVE-2025-9314 The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component	9.8 Critical	—	0,30%	2 Sep 2026
CVE-2025-8945 The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API.	5.3 Medium	—	0,21%	2 Sep 2026
CVE-2025-15692 The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow use...	3.5 Low	—	0,17%	2 Sep 2026
CVE-2025-15490 The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs	5.3 Medium	—	0,21%	2 Sep 2026
CVE-2025-15489 The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected c...	5.3 Medium	—	0,19%	2 Sep 2026
CVE-2025-15485 The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update th...	8.2 High	—	0,20%	2 Sep 2026
CVE-2025-15481 The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails.	5.3 Medium	—	0,19%	2 Sep 2026
CVE-2024-7956 A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have bas...	7.6 High	—	0,27%	2 Sep 2026
CVE-2024-3773 The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where th...	5.9 Medium	—	0,14%	2 Sep 2026
CVE-2023-3360 The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege u...	3.3 Low	—	0,15%	2 Sep 2026
CVE-2026-81269 data field project data field Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.	5.3 Medium	—	0,33%	2 Sep 2026
CVE-2026-81205 miniorange ldap / active directory integration Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. Th...	5.3 Medium	—	0,33%	2 Sep 2026
CVE-2026-81201 monster menus project monster menus Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster M...	6.1 Medium	—	0,26%	2 Sep 2026
CVE-2026-81168 captcha protected page project captcha protected page Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected...	3.7 Low	—	0,32%	2 Sep 2026
CVE-2026-81167 address suggestion project address suggestion Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This is...	4.8 Medium	—	0,24%	2 Sep 2026
CVE-2026-81166 lakedrops digital signage framework Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6...	5.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-81165 blazy project blazy Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.	5.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-81164 entity pdf project entity pdf Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.	5.4 Medium	—	0,23%	2 Sep 2026
CVE-2026-81162 dxpr builder project dxpr builder Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue a...	5.3 Medium	—	0,33%	2 Sep 2026
CVE-2026-81161 content moderation notifications project content moderation notifications Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifica...	3.3 Low	—	0,21%	2 Sep 2026
CVE-2026-81160 slick carousel project slick carousel Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Ca...	6.1 Medium	—	0,25%	2 Sep 2026
CVE-2026-81159 centarro commerce cybersource Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.	3.7 Low	—	0,26%	2 Sep 2026
CVE-2026-81158 entity api project entity api Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.	5.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-76782 Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: ..	7.3 High	—	0,29%	2 Sep 2026
CVE-2026-76759 Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: ..	7.3 High	—	0,29%	2 Sep 2026
CVE-2026-76758 Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: ..	5.9 Medium	—	0,35%	2 Sep 2026
CVE-2026-76757 Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: ..	5.9 Medium	—	0,36%	2 Sep 2026
CVE-2026-76756 Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: ..	5.9 Medium	—	0,36%	2 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.