Katalog CVE (hal. 531)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.295 (Critical 36.348 · High 105.272 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.501–26.550 dari 263.295 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-19616 Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: b...	7.5 High	—	0,24%	31 Agt 2026
CVE-2026-82696 A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php. This mani...	6.3 Medium	—	0,33%	31 Agt 2026
CVE-2026-82695 A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulatio...	10.0 Critical	—	1,4%	31 Agt 2026
CVE-2026-82694 A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The man...	10.0 Critical	—	1,4%	31 Agt 2026
CVE-2026-82693 A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Execut...	10.0 Critical	—	1,4%	31 Agt 2026
CVE-2026-82692 A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the...	9.9 Critical	—	3,3%	31 Agt 2026
CVE-2026-74010 Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: fro...	5.3 Medium	—	0,31%	31 Agt 2026
CVE-2026-5956 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This iss...	8.8 High	—	0,43%	31 Agt 2026
CVE-2026-51667 Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings...	4.3 Medium	—	0,29%	31 Agt 2026
CVE-2026-51666 Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initiali...	4.3 Medium	—	0,29%	31 Agt 2026
CVE-2026-12894 A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsibl...	8.8 High	—	0,51%	31 Agt 2026
CVE-2026-82797 Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef65496...	5.5 Medium	—	0,15%	31 Agt 2026
CVE-2026-82691 A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bi...	9.1 Critical	—	3,6%	31 Agt 2026
CVE-2026-82690 A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This man...	9.1 Critical	—	3,6%	31 Agt 2026
CVE-2026-82689 A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of t...	9.9 Critical	—	3,3%	31 Agt 2026
CVE-2026-76984 apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. I...	5.4 Medium	—	0,51%	31 Agt 2026
CVE-2026-76983 apache wicket Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResol...	5.4 Medium	—	0,51%	31 Agt 2026
CVE-2026-76982 apache wicket Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its const...	5.4 Medium	—	0,51%	31 Agt 2026
CVE-2026-75802 apache wicket AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's mark...	5.4 Medium	—	0,51%	31 Agt 2026
CVE-2026-71378 apache wicket ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to co...	4.6 Medium	—	0,25%	31 Agt 2026
CVE-2026-71257 apache wicket Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request body has al...	7.5 High	—	0,74%	31 Agt 2026
CVE-2026-70449 apache wicket Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WE...	5.3 Medium	—	0,91%	31 Agt 2026
CVE-2026-82881 Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject...	5.4 Medium	—	0,31%	31 Agt 2026
CVE-2026-82880 YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity res...	7.5 High	—	0,60%	31 Agt 2026
CVE-2026-82879 DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for...	6.3 Medium	—	0,36%	31 Agt 2026
CVE-2026-82878 DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authentica...	6.3 Medium	—	0,34%	31 Agt 2026
CVE-2026-82877 ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files...	6.5 Medium	—	0,55%	31 Agt 2026
CVE-2026-82876 Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage....	8.2 High	—	0,12%	31 Agt 2026
CVE-2026-82688 A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_...	9.1 Critical	—	3,6%	31 Agt 2026
CVE-2026-82680 A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /load_file.cgi of the component Multipart Handler. Executing a manipu...	8.8 High	—	0,84%	31 Agt 2026
CVE-2026-82679 A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetCon...	6.3 Medium	—	0,37%	31 Agt 2026
CVE-2026-82678 A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/a...	4.7 Medium	—	2,2%	31 Agt 2026
CVE-2026-82677 A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. Th...	2.4 Low	—	0,52%	31 Agt 2026
CVE-2026-82671 A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component IR...	3.4 Low	—	0,16%	31 Agt 2026
CVE-2026-82670 A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL Handler. Exe...	4.4 Medium	—	0,15%	31 Agt 2026
CVE-2026-82669 A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the...	5.3 Medium	—	0,74%	31 Agt 2026
CVE-2026-49003 Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously,...	9.6 Critical	—	2,4%	31 Agt 2026
CVE-2026-19873 HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable eleme...	7.5 High	—	0,52%	31 Agt 2026
CVE-2026-82875 ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it ma...	5.5 Medium	—	0,22%	31 Agt 2026
CVE-2026-82874 ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, all...	9.9 Critical	—	0,44%	31 Agt 2026
CVE-2026-82873 ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to disclose Too...	5.0 Medium	—	0,31%	31 Agt 2026
CVE-2026-82872 ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A worksp...	9.1 Critical	—	0,51%	31 Agt 2026
CVE-2026-82871 ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas a...	7.7 High	—	0,41%	31 Agt 2026
CVE-2026-82870 ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables...	9.6 Critical	—	0,43%	31 Agt 2026
CVE-2026-82869 ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated us...	7.7 High	—	0,41%	31 Agt 2026
CVE-2026-82868 @pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sa...	6.1 Medium	—	0,26%	31 Agt 2026
CVE-2026-82867 @pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into...	6.1 Medium	—	0,31%	31 Agt 2026
CVE-2026-82866 @pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf...	6.8 Medium	—	0,35%	31 Agt 2026
CVE-2026-82865 pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML....	4.4 Medium	—	0,20%	31 Agt 2026
CVE-2026-82864 pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of s...	6.5 Medium	—	0,44%	31 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.