Katalog CVE (hal. 530)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.295 (Critical 36.348 · High 105.272 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.451–26.500 dari 263.295 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-82801 A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of...	7.3 High	—	0,47%	31 Agt 2026
CVE-2026-82703 A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPing Endpoint...	6.6 Medium	—	2,9%	31 Agt 2026
CVE-2026-82702 A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp_WlanMP Endpoint. Such manipulatio...	6.6 Medium	—	2,9%	31 Agt 2026
CVE-2026-82701 A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component...	7.3 High	—	0,43%	31 Agt 2026
CVE-2026-78422 Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.fre...	7.3 High	—	0,13%	31 Agt 2026
CVE-2026-66047 ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to inst...	8.1 High	—	0,92%	31 Agt 2026
CVE-2026-59111 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on...	9.3 Critical	—	1,3%	31 Agt 2026
CVE-2026-51697 Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51696 Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose internal services via sending...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51695 Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted...	7.5 High	—	0,47%	31 Agt 2026
CVE-2026-51694 Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or change static DHCP rules via s...	7.5 High	—	0,47%	31 Agt 2026
CVE-2026-51693 Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafte...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51692 Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish or weaken guest wireless acces...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51691 Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51690 Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity v...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51689 Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes v...	9.1 Critical	—	0,62%	31 Agt 2026
CVE-2026-51688 Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial...	7.5 High	—	0,60%	31 Agt 2026
CVE-2026-51687 Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create or weaken guest wireless acces...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51686 Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51684 Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the storage-related service state vi...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51683 Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a...	4.3 Medium	—	0,29%	31 Agt 2026
CVE-2026-82700 A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the compo...	4.3 Medium	—	0,47%	31 Agt 2026
CVE-2026-82699 A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the c...	2.7 Low	—	0,25%	31 Agt 2026
CVE-2026-82698 A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown function of the file aca.sql....	5.3 Medium	—	0,53%	31 Agt 2026
CVE-2026-82697 A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function ses...	3.7 Low	—	0,46%	31 Agt 2026
CVE-2026-82217 In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and stat...	8.8 High	—	0,62%	31 Agt 2026
CVE-2026-78079 Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings wi...	5.3 Medium	—	0,41%	31 Agt 2026
CVE-2026-78078 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension...	8.9 High	—	0,44%	31 Agt 2026
CVE-2026-78077 Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized column and ite...	8.6 High	—	0,42%	31 Agt 2026
CVE-2026-78076 Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settin...	5.1 Medium	—	0,39%	31 Agt 2026
CVE-2026-78075 Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whether the user...	5.1 Medium	—	0,39%	31 Agt 2026
CVE-2026-78074 Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthen...	8.8 High	—	0,54%	31 Agt 2026
CVE-2026-76986 apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownCh...	6.1 Medium	—	0,57%	31 Agt 2026
CVE-2026-76985 apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which rend...	5.4 Medium	—	0,51%	31 Agt 2026
CVE-2026-76763 A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated rem...	7.5 High	—	0,79%	31 Agt 2026
CVE-2026-51681 Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration via sending...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51680 Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51679 Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via send...	9.1 Critical	—	0,62%	31 Agt 2026
CVE-2026-51678 Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafte...	4.3 Medium	—	0,29%	31 Agt 2026
CVE-2026-51677 Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP service state via sending a craft...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51676 Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter access-device policies via send...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51675 Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a cr...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51674 Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51673 Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter time synchronization settings via sendin...	7.5 High	—	0,47%	31 Agt 2026
CVE-2026-51672 Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sen...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51671 Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud firmware download st...	7.5 High	—	0,50%	31 Agt 2026
CVE-2026-51670 Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to query slave upgrade status and affect upg...	9.8 Critical	—	0,64%	31 Agt 2026
CVE-2026-51669 Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave configuration v...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-51668 Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify language configuration via sending...	7.5 High	—	0,47%	31 Agt 2026
CVE-2026-19702 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus...	7.8 High	—	0,49%	31 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.