Katalog CVE (hal. 515)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.701–25.750 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-82958 In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder valu...	7.6 High	—	0,41%	2 Sep 2026
CVE-2026-32773 apache spark There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could le...	6.1 Medium	—	0,41%	2 Sep 2026
CVE-2026-19219 In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an att...	8.1 High	—	0,16%	2 Sep 2026
CVE-2026-18672 In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file i...	7.5 High	—	0,36%	2 Sep 2026
CVE-2026-84175 In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of...	5.3 Medium	—	0,40%	2 Sep 2026
CVE-2026-53683 reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed b...	4.3 Medium	—	0,28%	2 Sep 2026
CVE-2026-75528 The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 d...	7.2 High	—	0,53%	2 Sep 2026
CVE-2026-14828 Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authentic...	8.8 High	—	1,4%	2 Sep 2026
CVE-2025-7963 The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up to, and incl...	6.4 Medium	—	0,19%	2 Sep 2026
CVE-2026-82883 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Log...	7.1 High	—	0,25%	2 Sep 2026
CVE-2026-3850 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` shortcode in all versions up to, an...	6.4 Medium	—	0,26%	2 Sep 2026
CVE-2026-82183 The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attacke...	8.1 High	—	0,38%	2 Sep 2026
CVE-2026-82182 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing a...	4.1 Medium	—	0,31%	2 Sep 2026
CVE-2026-81807 The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML a...	8.8 High	—	0,51%	2 Sep 2026
CVE-2026-81737 The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admi...	8.8 High	—	0,45%	2 Sep 2026
CVE-2026-81583 The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users wi...	5.4 Medium	—	0,30%	2 Sep 2026
CVE-2026-81432 The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user wit...	4.3 Medium	—	0,17%	2 Sep 2026
CVE-2026-81428 The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated u...	6.5 Medium	—	0,30%	2 Sep 2026
CVE-2026-81427 The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing an...	4.3 Medium	—	0,25%	2 Sep 2026
CVE-2026-81426 The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make...	4.3 Medium	—	0,17%	2 Sep 2026
CVE-2026-81199 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing un...	5.3 Medium	—	0,47%	2 Sep 2026
CVE-2026-81198 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated...	3.8 Low	—	0,32%	2 Sep 2026
CVE-2026-81197 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that list...	5.3 Medium	—	0,35%	2 Sep 2026
CVE-2026-81196 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor acces...	2.7 Low	—	0,30%	2 Sep 2026
CVE-2026-81195 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress d...	5.3 Medium	—	0,35%	2 Sep 2026
CVE-2026-81194 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticat...	4.3 Medium	—	0,27%	2 Sep 2026
CVE-2026-80467 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually...	8.1 High	—	0,37%	2 Sep 2026
CVE-2026-79621 The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notifica...	4.3 Medium	—	0,15%	2 Sep 2026
CVE-2026-78657 The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_fi...	9.8 Critical	—	1,0%	2 Sep 2026
CVE-2026-78151 The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public sub...	5.3 Medium	—	0,35%	2 Sep 2026
CVE-2026-77792 The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page...	7.5 High	—	0,37%	2 Sep 2026
CVE-2026-77788 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing use...	4.9 Medium	—	0,33%	2 Sep 2026
CVE-2026-77787 The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object id...	2.7 Low	—	0,28%	2 Sep 2026
CVE-2026-77785 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returnin...	2.7 Low	—	0,30%	2 Sep 2026
CVE-2026-77784 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, all...	2.7 Low	—	0,28%	2 Sep 2026
CVE-2026-77783 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated v...	3.7 Low	—	0,26%	2 Sep 2026
CVE-2026-77782 The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata...	5.3 Medium	—	0,35%	2 Sep 2026
CVE-2026-77764 The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award...	4.3 Medium	—	0,25%	2 Sep 2026
CVE-2026-74927 The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retr...	5.3 Medium	—	0,32%	2 Sep 2026
CVE-2026-19723 The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it...	7.1 High	—	0,18%	2 Sep 2026
CVE-2026-19719 The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event hand...	6.8 Medium	—	0,29%	2 Sep 2026
CVE-2026-19704 The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they...	5.3 Medium	—	0,26%	2 Sep 2026
CVE-2026-19453 The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it admi...	7.1 High	—	0,19%	2 Sep 2026
CVE-2026-19251 The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning...	5.3 Medium	—	0,23%	2 Sep 2026
CVE-2026-19116 The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend ed...	8.8 High	—	0,42%	2 Sep 2026
CVE-2026-16983 The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-prot...	4.3 Medium	—	0,21%	2 Sep 2026
CVE-2026-16966 The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to r...	5.3 Medium	—	0,24%	2 Sep 2026
CVE-2026-15232 The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on a...	5.3 Medium	—	0,22%	2 Sep 2026
CVE-2026-14357 The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing...	8.8 High	—	0,65%	2 Sep 2026
CVE-2026-14215 The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking a...	6.5 Medium	—	0,31%	2 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.