Katalog CVE (hal. 514)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.651–25.700 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-76755 Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: ..	5.9 Medium	—	0,36%	2 Sep 2026
CVE-2026-73478 diff project diff Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.	5.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-73477 quick tabs project quick tabs Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.	5.3 Medium	—	0,32%	2 Sep 2026
CVE-2026-73476 external authentication project external authentication Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: fr...	5.4 Medium	—	0,30%	2 Sep 2026
CVE-2026-73475 centarro commerce paypal Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to...	9.1 Critical	—	0,40%	2 Sep 2026
CVE-2026-73474 entity share websub project entity share websub Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0...	5.3 Medium	—	0,34%	2 Sep 2026
CVE-2026-18986 entity browser project entity browser Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity B...	4.8 Medium	—	0,14%	2 Sep 2026
CVE-2026-16647 zyxware disable login page Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page ver...	4.1 Medium	—	0,27%	2 Sep 2026
CVE-2026-84835 Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: f...	5.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-84808 Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access contro...	4.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-84807 Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with pro...	5.4 Medium	—	0,25%	2 Sep 2026
CVE-2026-84806 Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only acc...	5.4 Medium	—	0,24%	2 Sep 2026
CVE-2026-84805 Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. A...	4.3 Medium	—	0,29%	2 Sep 2026
CVE-2026-84804 Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with ed...	5.4 Medium	—	0,33%	2 Sep 2026
CVE-2026-84803 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types....	9.0 Critical	—	0,43%	2 Sep 2026
CVE-2026-84802 Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions....	4.3 Medium	—	0,28%	2 Sep 2026
CVE-2026-84801 Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to m...	8.8 High	—	0,44%	2 Sep 2026
CVE-2026-84800 Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId...	7.1 High	—	0,35%	2 Sep 2026
CVE-2026-84799 Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator...	4.3 Medium	—	0,28%	2 Sep 2026
CVE-2026-84798 Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element...	7.1 High	—	0,35%	2 Sep 2026
CVE-2026-84797 Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntrie...	6.3 Medium	—	0,29%	2 Sep 2026
CVE-2026-84796 Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prep...	8.8 High	—	0,47%	2 Sep 2026
CVE-2026-84795 Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a...	9.8 Critical	—	0,51%	2 Sep 2026
CVE-2026-84794 Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions...	7.1 High	—	0,35%	2 Sep 2026
CVE-2026-84793 Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators c...	4.8 Medium	—	0,25%	2 Sep 2026
CVE-2026-84792 Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entr...	4.3 Medium	—	0,30%	2 Sep 2026
CVE-2026-84781 Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.	6.5 Medium	—	0,22%	2 Sep 2026
CVE-2026-84780 Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.	5.3 Medium	—	0,40%	2 Sep 2026
CVE-2026-84775 Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.	5.3 Medium	—	0,40%	2 Sep 2026
CVE-2026-84772 Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.	5.5 Medium	—	0,26%	2 Sep 2026
CVE-2026-84771 Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.	5.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-84770 Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.	8.8 High	—	0,20%	2 Sep 2026
CVE-2026-84764 Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.	8.8 High	—	0,20%	2 Sep 2026
CVE-2026-84760 Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.	5.3 Medium	—	0,31%	2 Sep 2026
CVE-2026-84759 Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.	7.1 High	—	0,13%	2 Sep 2026
CVE-2026-84217 Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff...	5.4 Medium	—	0,29%	2 Sep 2026
CVE-2026-83562 Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.	6.5 Medium	—	0,22%	2 Sep 2026
CVE-2026-82223 Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.	6.5 Medium	—	0,33%	2 Sep 2026
CVE-2026-81775 Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.	7.1 High	—	0,25%	2 Sep 2026
CVE-2026-81774 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve...	7.5 High	—	0,42%	2 Sep 2026
CVE-2026-81772 Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.	8.8 High	—	0,46%	2 Sep 2026
CVE-2026-81771 Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.	7.1 High	—	0,25%	2 Sep 2026
CVE-2026-81770 Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.	7.1 High	—	0,25%	2 Sep 2026
CVE-2026-81769 Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1.	8.8 High	—	0,42%	2 Sep 2026
CVE-2026-81294 Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.	9.8 Critical	—	0,48%	2 Sep 2026
CVE-2026-81289 Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.	7.1 High	—	0,25%	2 Sep 2026
CVE-2026-81288 Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.	7.1 High	—	0,25%	2 Sep 2026
CVE-2026-81286 Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.	9.3 Critical	—	0,40%	2 Sep 2026
CVE-2026-81283 Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.	8.8 High	—	0,52%	2 Sep 2026
CVE-2026-66652 Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.	5.4 Medium	—	0,14%	2 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.