Katalog CVE (hal. 535)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.295 (Critical 36.348 · High 105.272 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 26.701–26.750 dari 263.295 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-82488 A vulnerability was identified in Beetel 450TC3 01.00.00_01. This vulnerability affects unknown code of the component User Management. The manipulation of the argument Us...	3.5 Low	—	0,33%	30 Agt 2026
CVE-2026-82487 A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The attack can be...	6.3 Medium	—	0,35%	30 Agt 2026
CVE-2026-82486 A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow. Performing a manip...	5.0 Medium	—	0,33%	30 Agt 2026
CVE-2026-82485 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pro_edit.php....	6.3 Medium	—	0,33%	30 Agt 2026
CVE-2026-82484 A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/emp_searchfrm.php. This manipulation of the argum...	6.3 Medium	—	0,33%	30 Agt 2026
CVE-2026-82483 A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file db_input.php of the component Hidde...	3.5 Low	—	0,35%	30 Agt 2026
CVE-2026-82482 A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the co...	3.5 Low	—	0,35%	30 Agt 2026
CVE-2026-81766 The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before...	6.6 Medium	—	0,44%	30 Agt 2026
CVE-2026-81660 The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields b...	8.8 High	—	0,51%	30 Agt 2026
CVE-2026-78364 The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could al...	3.5 Low	—	0,24%	30 Agt 2026
CVE-2026-76585 The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which...	8.8 High	—	0,51%	30 Agt 2026
CVE-2026-19722 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, a...	6.6 Medium	—	0,26%	30 Agt 2026
CVE-2026-14835 The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post...	6.8 Medium	—	0,23%	30 Agt 2026
CVE-2026-14307 The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HT...	7.1 High	—	0,16%	30 Agt 2026
CVE-2026-82480 A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLength of the file src/cFS/cfe/modules/sb/fsw/src/cfe_...	7.4 High	—	0,38%	30 Agt 2026
CVE-2026-82479 A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file modules/protocol/tcp/fsw/src/sbn_tcp_if.c of the component SBN TCP Mo...	6.3 Medium	—	0,38%	30 Agt 2026
CVE-2026-82478 A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_services/JSONVar...	7.3 High	—	0,54%	30 Agt 2026
CVE-2026-15980 The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_...	9.8 Critical	—	0,45%	30 Agt 2026
CVE-2026-77846 Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse i...	2.1 Low	—	0,20%	30 Agt 2026
CVE-2026-75759 Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID toke...	7.6 High	—	0,22%	30 Agt 2026
CVE-2026-82562 ### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split in...	3.7 Low	—	0,54%	30 Agt 2026
CVE-2026-77970 Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover s...	5.9 Medium	—	0,12%	30 Agt 2026
CVE-2026-77831 Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update a...	2.1 Low	—	0,18%	30 Agt 2026
CVE-2026-75847 Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover t...	5.9 Medium	—	0,12%	30 Agt 2026
CVE-2026-82417 ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBu...	5.3 Medium	—	0,40%	30 Agt 2026
CVE-2026-82424 A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /student_edit1.php. Ex...	6.3 Medium	—	0,34%	29 Agt 2026
CVE-2026-82423 A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status E...	5.4 Medium	—	0,44%	29 Agt 2026
CVE-2026-82422 A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_del.php. The manipulation of th...	6.3 Medium	—	0,33%	29 Agt 2026
CVE-2026-82421 A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/emp_edit.php. The manipulatio...	6.3 Medium	—	0,33%	29 Agt 2026
CVE-2026-15369 The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the...	9.8 Critical	—	0,40%	29 Agt 2026
CVE-2026-75807 The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_...	7.5 High	—	0,41%	29 Agt 2026
CVE-2026-82476 Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypa...	5.3 Medium	—	0,43%	29 Agt 2026
CVE-2026-82475 iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attack...	8.1 High	—	0,45%	29 Agt 2026
CVE-2026-82474 Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can exec...	7.8 High	—	0,13%	29 Agt 2026
CVE-2026-82473 KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to...	8.2 High	—	0,64%	29 Agt 2026
CVE-2026-82472 Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticat...	7.5 High	—	0,76%	29 Agt 2026
CVE-2026-82470 Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who o...	5.4 Medium	—	0,41%	29 Agt 2026
CVE-2026-82469 Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attack...	5.4 Medium	—	0,41%	29 Agt 2026
CVE-2026-82468 Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin...	4.7 Medium	—	0,18%	29 Agt 2026
CVE-2026-82467 Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested...	4.7 Medium	—	0,33%	29 Agt 2026
CVE-2026-82466 Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attack...	8.7 High	—	0,61%	29 Agt 2026
CVE-2026-82465 pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no Session...	5.3 Medium	—	0,26%	29 Agt 2026
CVE-2026-82464 pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrl...	6.1 Medium	—	0,35%	29 Agt 2026
CVE-2026-82463 pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authe...	8.1 High	—	0,55%	29 Agt 2026
CVE-2026-82462 pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens min...	6.5 Medium	—	0,20%	29 Agt 2026
CVE-2026-82461 pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access...	8.1 High	—	0,32%	29 Agt 2026
CVE-2026-82460 Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalizati...	9.8 Critical	—	0,90%	29 Agt 2026
CVE-2026-82481 The cohttp package before 6.3.0 for OCaml allows directory traversal.	8.7 High	—	0,70%	29 Agt 2026
CVE-2026-82477 In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This...	5.8 Medium	—	0,48%	29 Agt 2026
CVE-2026-82457 su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range value...	7.8 High	—	0,18%	29 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.