Katalog CVE (hal. 527)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.288 (Critical 36.348 · High 105.269 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.301–26.350 dari 263.288 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-81891 elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls m...	8.1 High	—	0,90%	31 Agt 2026
CVE-2026-81890 elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProt...	5.4 Medium	—	0,18%	31 Agt 2026
CVE-2026-81889 elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-...	8.6 High	—	0,55%	31 Agt 2026
CVE-2026-81888 @hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` va...	5.4 Medium	—	0,19%	31 Agt 2026
CVE-2026-81887 Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fro...	5.1 Medium	—	0,68%	31 Agt 2026
CVE-2026-81780 Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.	10.0 Critical	—	0,52%	31 Agt 2026
CVE-2026-81779 Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1...	10.0 Critical	—	0,52%	31 Agt 2026
CVE-2026-81778 Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.	6.5 Medium	—	0,22%	31 Agt 2026
CVE-2026-81768 Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.	7.1 High	—	0,25%	31 Agt 2026
CVE-2026-81765 Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.	7.1 High	—	0,25%	31 Agt 2026
CVE-2026-81764 Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.	7.1 High	—	0,25%	31 Agt 2026
CVE-2026-81763 Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.	9.3 Critical	—	0,40%	31 Agt 2026
CVE-2026-81762 Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.	6.5 Medium	—	0,30%	31 Agt 2026
CVE-2026-81758 Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.	6.3 Medium	—	0,26%	31 Agt 2026
CVE-2026-81756 Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.	9.3 Critical	—	0,40%	31 Agt 2026
CVE-2026-81298 Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.	7.1 High	—	0,25%	31 Agt 2026
CVE-2026-81297 Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.	7.5 High	—	0,32%	31 Agt 2026
CVE-2026-81296 Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.	7.5 High	—	0,35%	31 Agt 2026
CVE-2026-81293 Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.	9.3 Critical	—	0,40%	31 Agt 2026
CVE-2026-81291 Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.	7.1 High	—	0,25%	31 Agt 2026
CVE-2026-81290 Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.	7.1 High	—	0,25%	31 Agt 2026
CVE-2026-81287 Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.	8.5 High	—	0,36%	31 Agt 2026
CVE-2026-81280 Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.	6.5 Medium	—	0,37%	31 Agt 2026
CVE-2026-81278 Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4....	5.4 Medium	—	0,29%	31 Agt 2026
CVE-2026-79483 FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inje...	5.3 Medium	—	0,40%	31 Agt 2026
CVE-2026-79408 An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metag...	9.8 Critical	—	2,1%	31 Agt 2026
CVE-2026-79407 A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_m...	7.5 High	—	0,50%	31 Agt 2026
CVE-2026-75594 Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\M...	8.2 High	—	0,76%	31 Agt 2026
CVE-2026-75592 Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment c...	6.9 Medium	—	0,68%	31 Agt 2026
CVE-2026-75460 XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in Us...	6.5 Medium	—	0,34%	31 Agt 2026
CVE-2026-75458 The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This inte...	8.1 High	—	0,38%	31 Agt 2026
CVE-2026-71415 Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload aut...	7.1 High	—	0,43%	31 Agt 2026
CVE-2026-62993 Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release lin...	6.9 Medium	—	0,57%	31 Agt 2026
CVE-2026-61641 Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to...	8.1 High	—	0,53%	31 Agt 2026
CVE-2026-61640 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_o...	8.5 High	—	0,54%	31 Agt 2026
CVE-2026-61639 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without valida...	8.5 High	—	0,51%	31 Agt 2026
CVE-2026-61638 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddres...	8.2 High	—	0,50%	31 Agt 2026
CVE-2026-54600 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-tab...	8.2 High	—	0,58%	31 Agt 2026
CVE-2026-54599 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'],...	7.5 High	—	0,22%	31 Agt 2026
CVE-2026-54598 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called ov...	7.5 High	—	0,46%	31 Agt 2026
CVE-2026-54179 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. F...	4.4 Medium	—	0,26%	31 Agt 2026
CVE-2026-50199 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API Layer cred...	4.3 Medium	—	0,26%	31 Agt 2026
CVE-2026-50198 Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set repl...	4.3 Medium	—	0,29%	31 Agt 2026
CVE-2026-38577 Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.	9.8 Critical	—	0,48%	31 Agt 2026
CVE-2025-63607 TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting executi...	6.1 Medium	—	0,22%	31 Agt 2026
CVE-2026-82905 A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the com...	6.3 Medium	—	0,38%	31 Agt 2026
CVE-2026-82835 A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argume...	5.4 Medium	—	0,38%	31 Agt 2026
CVE-2026-82834 A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Au...	5.4 Medium	—	0,38%	31 Agt 2026
CVE-2026-82833 A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automat...	6.3 Medium	—	0,35%	31 Agt 2026
CVE-2026-81267 mozilla firefox mobile A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attac...	5.4 Medium	—	0,26%	31 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.