Katalog CVE (hal. 525)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.288 (Critical 36.348 · High 105.269 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.201–26.250 dari 263.288 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-84059 A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname....	7.4 High	—	2,0%	1 Sep 2026
CVE-2026-82927 Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06994e303637512e39062f3e037c222e...	5.5 Medium	—	0,15%	1 Sep 2026
CVE-2026-82926 NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c374...	5.5 Medium	—	0,15%	1 Sep 2026
CVE-2026-4813 A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT proc...	9.4 Critical	—	0,53%	1 Sep 2026
CVE-2026-59681 A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on t...	8.8 High	—	1,5%	1 Sep 2026
CVE-2026-59680 An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb...	8.0 High	—	1,6%	1 Sep 2026
CVE-2026-25706 Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree...	7.5 High	—	0,48%	1 Sep 2026
CVE-2026-19914 The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due...	7.2 High	—	0,34%	1 Sep 2026
CVE-2026-16788 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode in all vers...	6.4 Medium	—	0,20%	1 Sep 2026
CVE-2026-16786 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode in all...	6.4 Medium	—	0,20%	1 Sep 2026
CVE-2026-15101 The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to in...	6.4 Medium	—	0,20%	1 Sep 2026
CVE-2026-78363 The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it l...	4.8 Medium	—	0,24%	1 Sep 2026
CVE-2026-74916 The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested w...	6.5 Medium	—	0,15%	1 Sep 2026
CVE-2026-13611 The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient...	5.3 Medium	—	0,19%	1 Sep 2026
CVE-2026-78319 A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition. An unauthenticated remote attacker could exploit this r...	9.3 Critical	—	0,61%	1 Sep 2026
CVE-2026-83772 A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail-rep...	9.9 Critical	—	3,2%	1 Sep 2026
CVE-2026-77189 The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection...	6.5 Medium	—	0,47%	1 Sep 2026
CVE-2026-75980 The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attrib...	6.4 Medium	—	0,35%	1 Sep 2026
CVE-2026-75964 The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '...	6.1 Medium	—	0,38%	1 Sep 2026
CVE-2026-18488 The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up to, and in...	6.4 Medium	—	0,33%	1 Sep 2026
CVE-2026-83744 A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Service...	4.3 Medium	—	0,35%	1 Sep 2026
CVE-2026-83743 A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profil...	6.3 Medium	—	0,38%	1 Sep 2026
CVE-2026-82747 Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :runtime read...	5.9 Medium	—	0,17%	1 Sep 2026
CVE-2026-77823 The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4...	4.9 Medium	—	0,44%	1 Sep 2026
CVE-2026-76006 The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including...	4.9 Medium	—	0,59%	1 Sep 2026
CVE-2026-75965 The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date...	6.4 Medium	—	0,33%	1 Sep 2026
CVE-2026-75921 The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitr...	7.2 High	—	1,2%	1 Sep 2026
CVE-2026-19952 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in al...	7.5 High	—	0,96%	1 Sep 2026
CVE-2026-19948 The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all vers...	5.3 Medium	—	0,39%	1 Sep 2026
CVE-2026-19806 The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Admini...	8.8 High	—	0,40%	1 Sep 2026
CVE-2026-19796 The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Paramet...	7.2 High	—	0,24%	1 Sep 2026
CVE-2026-19573 The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including...	7.2 High	—	0,24%	1 Sep 2026
CVE-2026-18752 The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to insufficie...	6.5 Medium	—	0,25%	1 Sep 2026
CVE-2026-17589 The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to, and including, 5....	4.9 Medium	—	0,27%	1 Sep 2026
CVE-2026-16787 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all versions up...	6.4 Medium	—	0,19%	1 Sep 2026
CVE-2026-13203 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_m...	6.4 Medium	—	0,24%	1 Sep 2026
CVE-2026-12747 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.2...	6.4 Medium	—	0,20%	1 Sep 2026
CVE-2026-82749 Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field c...	5.9 Medium	—	0,17%	1 Sep 2026
CVE-2026-82748 Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with poli...	2.1 Low	—	0,17%	1 Sep 2026
CVE-2026-82746 Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4. Ash...	5.9 Medium	—	0,17%	1 Sep 2026
CVE-2026-82745 Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enfo...	5.9 Medium	—	0,17%	1 Sep 2026
CVE-2026-82744 Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not....	2.1 Low	—	0,19%	1 Sep 2026
CVE-2026-82743 Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. As...	2.1 Low	—	0,18%	1 Sep 2026
CVE-2026-82742 Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in...	5.9 Medium	—	0,18%	1 Sep 2026
CVE-2026-82741 Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage:...	2.1 Low	—	0,19%	1 Sep 2026
CVE-2026-82740 Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting inv...	2.1 Low	—	0,18%	1 Sep 2026
CVE-2026-82739 Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its co...	2.1 Low	—	0,18%	1 Sep 2026
CVE-2026-82738 Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7...	5.9 Medium	—	0,18%	1 Sep 2026
CVE-2026-82737 Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than...	5.9 Medium	—	0,18%	1 Sep 2026
CVE-2026-82736 Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or...	2.1 Low	—	0,18%	1 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.