Katalog CVE (hal. 516)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.280 (Critical 36.347 · High 105.266 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 25.751–25.800 dari 263.280 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-12865 The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (o...	7.1 High	—	0,20%	2 Sep 2026
CVE-2026-12526 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user...	8.1 High	—	0,23%	2 Sep 2026
CVE-2025-15664 The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side s...	6.8 Medium	—	0,29%	2 Sep 2026
CVE-2025-15663 The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side sc...	6.8 Medium	—	0,29%	2 Sep 2026
CVE-2026-9055 The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to ins...	9.8 Critical	—	0,51%	2 Sep 2026
CVE-2025-46418 Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.	7.6 High	—	0,68%	2 Sep 2026
CVE-2024-35585 Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.	8.6 High	—	0,28%	2 Sep 2026
CVE-2026-3851 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27....	6.4 Medium	—	0,28%	2 Sep 2026
CVE-2026-19754 Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify...	8.6 High	—	0,39%	2 Sep 2026
CVE-2026-84442 A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule....	4.4 Medium	—	0,21%	2 Sep 2026
CVE-2026-84441 A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivativ...	7.3 High	—	0,59%	2 Sep 2026
CVE-2026-14982 The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This m...	8.1 High	—	0,52%	2 Sep 2026
CVE-2026-14957 In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL...	7.5 High	—	0,47%	2 Sep 2026
CVE-2026-84715 FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own per...	8.8 High	—	0,56%	2 Sep 2026
CVE-2026-84485 APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names...	7.5 High	—	0,61%	2 Sep 2026
CVE-2026-84484 ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sendin...	7.5 High	—	0,87%	2 Sep 2026
CVE-2026-84438 A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete...	3.5 Low	—	0,33%	2 Sep 2026
CVE-2026-84437 A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Aut...	3.5 Low	—	0,33%	2 Sep 2026
CVE-2026-84431 A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the componen...	4.4 Medium	—	0,21%	2 Sep 2026
CVE-2026-82968 A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account,...	6.4 Medium	—	0,28%	2 Sep 2026
CVE-2026-84702 facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply trave...	7.5 High	—	0,44%	2 Sep 2026
CVE-2026-84701 NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can...	5.4 Medium	—	0,30%	2 Sep 2026
CVE-2026-84700 PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client port 9221 is u...	8.6 High	—	0,58%	2 Sep 2026
CVE-2026-84699 Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local a...	9.1 Critical	—	0,63%	2 Sep 2026
CVE-2026-84698 PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation. Attackers...	6.5 Medium	—	0,43%	2 Sep 2026
CVE-2026-84697 Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-sid...	5.3 Medium	—	0,40%	2 Sep 2026
CVE-2026-84696 Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication m...	8.2 High	—	0,22%	2 Sep 2026
CVE-2026-84695 BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without...	8.7 High	—	0,47%	2 Sep 2026
CVE-2026-84694 Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject s...	8.8 High	—	0,85%	2 Sep 2026
CVE-2026-84430 A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the...	6.3 Medium	—	0,43%	2 Sep 2026
CVE-2026-84427 A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executin...	4.3 Medium	—	0,47%	2 Sep 2026
CVE-2026-84425 A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browser_tool.py of the component Browser...	4.3 Medium	—	0,47%	2 Sep 2026
CVE-2026-84359 google chrome Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafte...	3.1 Low	—	0,20%	2 Sep 2026
CVE-2026-84358 google chrome Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar...	4.2 Medium	—	0,22%	2 Sep 2026
CVE-2026-84357 google chrome Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via craft...	6.5 Medium	—	0,27%	2 Sep 2026
CVE-2026-84356 google chrome UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security seve...	4.3 Medium	—	0,25%	2 Sep 2026
CVE-2026-84355 google chrome Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin poli...	3.1 Low	—	0,24%	2 Sep 2026
CVE-2026-84354 google chrome Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside th...	9.6 Critical	—	0,44%	2 Sep 2026
CVE-2026-84353 google chrome Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary cod...	9.6 Critical	—	0,46%	2 Sep 2026
CVE-2026-84352 google chrome Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML p...	9.6 Critical	—	0,46%	2 Sep 2026
CVE-2026-84351 google chrome Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code...	8.3 High	—	0,44%	2 Sep 2026
CVE-2026-84350 google chrome Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox v...	8.8 High	—	0,38%	2 Sep 2026
CVE-2026-84349 google chrome Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the...	8.3 High	—	0,40%	2 Sep 2026
CVE-2026-84348 google chrome Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chr...	6.5 Medium	—	0,32%	2 Sep 2026
CVE-2026-84347 google chrome Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium...	8.8 High	—	0,52%	2 Sep 2026
CVE-2026-84335 google chrome Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engine...	8.3 High	—	0,39%	2 Sep 2026
CVE-2026-84334 google chrome Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a l...	8.1 High	—	0,12%	2 Sep 2026
CVE-2026-84333 google chrome Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML pa...	9.6 Critical	—	0,46%	2 Sep 2026
CVE-2026-84332 google chrome Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (C...	6.5 Medium	—	0,29%	2 Sep 2026
CVE-2026-84331 google chrome Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy vi...	3.1 Low	—	0,24%	2 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.