Katalog CVE (hal. 529)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.288 (Critical 36.348 · High 105.269 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.401–26.450 dari 263.288 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-51724 Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Smart QoS rules via sending a craf...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51723 Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to install a custom CGI module via sendi...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51722 Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repoint the device to an attacker-con...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51721 Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a cr...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51720 Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter rules via se...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-17615 A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a speciall...	7.5 High	—	0,62%	31 Agt 2026
CVE-2026-14366 The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c frees a network packet it does not own. In the Zephyr TX pa...	6.4 Medium	—	0,16%	31 Agt 2026
CVE-2026-83492 Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1.	6.9 Medium	—	0,41%	31 Agt 2026
CVE-2026-82807 A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. This issue affects some unknown processing in the library URDSCSI.sys of the component Kernel Driver....	8.8 High	—	0,16%	31 Agt 2026
CVE-2026-82805 A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argume...	4.3 Medium	—	0,49%	31 Agt 2026
CVE-2026-82803 A vulnerability has been found in armink struct2json 1.0. This affects the function S2J_STRUCT_GET_string_ELEMENT in the library struct2json/inc/s2jdef.h of the component...	5.3 Medium	—	0,70%	31 Agt 2026
CVE-2026-82802 A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSea...	5.3 Medium	—	0,48%	31 Agt 2026
CVE-2026-77975 The affected Ebyte product exports administrative credentials and other sensitive configuration information without adequate protection. An unauthenticated attacker o...	6.5 Medium	—	0,18%	31 Agt 2026
CVE-2026-77966 The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access s...	8.8 High	—	0,44%	31 Agt 2026
CVE-2026-76133 The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict t...	9.8 Critical	—	0,40%	31 Agt 2026
CVE-2026-75133 Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL...	7.5 High	—	0,52%	31 Agt 2026
CVE-2026-75132 WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated...	6.5 Medium	—	0,49%	31 Agt 2026
CVE-2026-73819 The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credentia...	9.8 Critical	—	0,53%	31 Agt 2026
CVE-2026-51719 Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove URL filtering rules via sending...	7.5 High	—	0,47%	31 Agt 2026
CVE-2026-51718 Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reservations via s...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51717 Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode via sendin...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51716 Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete port-forwarding rules via sen...	7.5 High	—	0,47%	31 Agt 2026
CVE-2026-51715 Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51714 Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter roaming behavior via sending a craft...	5.9 Medium	—	0,43%	31 Agt 2026
CVE-2026-51713 Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51712 Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter wireless availability windows via...	5.9 Medium	—	0,43%	31 Agt 2026
CVE-2026-51711 Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing window via sendi...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51710 Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behavior via sen...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51709 Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via s...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51708 Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS availability via sending a craf...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51706 Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade traffic handling via sending a cr...	4.3 Medium	—	0,31%	31 Agt 2026
CVE-2026-51705 Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafte...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51704 Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter mesh configurations via sending...	4.3 Medium	—	0,29%	31 Agt 2026
CVE-2026-51703 Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sen...	5.4 Medium	—	0,31%	31 Agt 2026
CVE-2026-51702 Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter firewall policies via sending...	4.3 Medium	—	0,29%	31 Agt 2026
CVE-2026-51701 Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access control via sendi...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51700 Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade wireless behavior via sending...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51699 Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51698 Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter browsing policies via sending a...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51153 Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler...	5.4 Medium	—	0,24%	31 Agt 2026
CVE-2026-51152 Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build_request() in libs/fetcher.py constructs an httpclient.HTTPRequ...	9.1 Critical	—	0,65%	31 Agt 2026
CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by impr...	3.1 Low	—	0,15%	31 Agt 2026
CVE-2026-82970 Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This iss...	10.0 Critical	—	0,52%	31 Agt 2026
CVE-2026-82801 A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of...	7.3 High	—	0,47%	31 Agt 2026
CVE-2026-82703 A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPing Endpoint...	6.6 Medium	—	2,9%	31 Agt 2026
CVE-2026-82702 A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp_WlanMP Endpoint. Such manipulatio...	6.6 Medium	—	2,9%	31 Agt 2026
CVE-2026-82701 A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component...	7.3 High	—	0,43%	31 Agt 2026
CVE-2026-78422 Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.fre...	7.3 High	—	0,13%	31 Agt 2026
CVE-2026-66047 ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to inst...	8.1 High	—	0,92%	31 Agt 2026
CVE-2026-59111 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on...	9.3 Critical	—	1,3%	31 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.