Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 25 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-51653
Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain storage feature state information v...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51652
Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mappin...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51651
Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Smart QoS configuration and rules...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51650
Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain remote-management enablement and por...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51649
Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping...
|
9.1 Critical | — | 0,51% | 28 Agt 2026 |
|
CVE-2026-51648
Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN information returned by the endpoi...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51647
Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL in...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51646
Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain parental-control rules via sendi...
|
9.1 Critical | — | 0,51% | 28 Agt 2026 |
|
CVE-2026-51645
Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the administrative username via se...
|
9.8 Critical | — | 0,64% | 28 Agt 2026 |
|
CVE-2026-51644
Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51643
Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data...
|
9.1 Critical | — | 0,51% | 28 Agt 2026 |
|
CVE-2026-51642
Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh routing information via...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51641
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51640
Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh neighbor information vi...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51639
Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain AP-specific Wi-Fi scheduling rule...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51638
Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration informa...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51637
Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh portal table information...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51636
Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via sending a cra...
|
9.1 Critical | — | 0,51% | 28 Agt 2026 |
|
CVE-2026-51635
Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via sen...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51634
Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain core wireless settings, including...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51633
Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi config...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51632
Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain advanced wireless settings via...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51631
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51630
Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain,...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51629
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51628
Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PI...
|
9.1 Critical | — | 0,51% | 28 Agt 2026 |
|
CVE-2026-51627
Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration informatio...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51626
Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS configuration, including the cu...
|
9.1 Critical | — | 0,51% | 28 Agt 2026 |
|
CVE-2026-51625
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as SSID...
|
7.5 High | — | 0,51% | 28 Agt 2026 |
|
CVE-2026-51624
Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain a client MAC address via sendin...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51623
Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP i...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51622
Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a cr...
|
9.1 Critical | — | 0,51% | 28 Agt 2026 |
|
CVE-2026-51621
Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive device configuration informa...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51620
Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain network topology and interface conf...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51619
Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain online client information via sen...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51618
Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configur...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51617
Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as ope...
|
7.5 High | — | 0,33% | 28 Agt 2026 |
|
CVE-2026-51616
Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51615
Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration i...
|
7.5 High | — | 0,50% | 28 Agt 2026 |
|
CVE-2026-51614
Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain access-device policy and clien...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51613
Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain device identification details via s...
|
4.3 Medium | — | 0,29% | 28 Agt 2026 |
|
CVE-2026-51611
Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending...
|
9.8 Critical | — | 0,64% | 28 Agt 2026 |
|
CVE-2026-51610
Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via s...
|
4.3 Medium | — | 0,33% | 28 Agt 2026 |
|
CVE-2026-51376
An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache
|
6.5 Medium | — | 0,40% | 28 Agt 2026 |
|
CVE-2026-50980
Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perf...
|
6.1 Medium | — | 0,40% | 28 Agt 2026 |
|
CVE-2026-39071
WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (...
|
5.4 Medium | — | 0,23% | 28 Agt 2026 |
|
CVE-2026-39070
WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role (admin...
|
4.8 Medium | — | 0,24% | 28 Agt 2026 |
|
CVE-2026-82330
gimp, redhat enterprise linux
A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds c...
|
6.1 Medium | — | 0,26% | 28 Agt 2026 |
|
CVE-2026-82328
gimp, redhat enterprise linux
A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) p...
|
6.1 Medium | — | 0,18% | 28 Agt 2026 |
|
CVE-2026-82327
A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When lib...
|
5.5 Medium | — | 0,16% | 28 Agt 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.