Katalog CVE (hal. 543)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.383 (Critical 36.349 · High 105.290 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 27.101–27.150 dari 263.383 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-81341 wolfssl wolfengine wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the...	6.5 Medium	—	0,32%	28 Agt 2026
CVE-2026-81299 Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.	4.3 Medium	—	0,25%	28 Agt 2026
CVE-2026-81285 Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.	7.5 High	—	0,46%	28 Agt 2026
CVE-2026-81284 Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.	4.3 Medium	—	0,25%	28 Agt 2026
CVE-2026-81020 wolfssl wolfengine wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and D...	7.4 High	—	0,38%	28 Agt 2026
CVE-2026-81019 wolfssl wolfprovider wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and...	7.4 High	—	0,38%	28 Agt 2026
CVE-2026-75758 Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to...	5.9 Medium	—	0,18%	28 Agt 2026
CVE-2026-6176 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and inc...	7.2 High	—	0,42%	28 Agt 2026
CVE-2026-5953 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ceviz Informatics Inc. Web Design allows Reflected XSS. This issue...	6.1 Medium	—	0,25%	28 Agt 2026
CVE-2026-5934 The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization...	7.2 High	—	0,34%	28 Agt 2026
CVE-2026-5800 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows...	6.1 Medium	—	0,25%	28 Agt 2026
CVE-2026-58107 CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size....	5.5 Medium	—	0,41%	28 Agt 2026
CVE-2026-58106 CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper. At ldlogger-tool-gcc.c:12...	2.0 Low	—	0,17%	28 Agt 2026
CVE-2026-5096 The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_v...	5.3 Medium	—	0,41%	28 Agt 2026
CVE-2026-56854 The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback pat...	7.5 High	—	0,44%	28 Agt 2026
CVE-2026-50979 A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary she...	8.1 High	—	1,9%	28 Agt 2026
CVE-2026-4378 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Sto...	5.4 Medium	—	0,23%	28 Agt 2026
CVE-2026-3423 The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and includin...	6.4 Medium	—	0,33%	28 Agt 2026
CVE-2026-38725 xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. Th...	5.4 Medium	—	0,31%	28 Agt 2026
CVE-2026-38638 An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,63%	28 Agt 2026
CVE-2026-38636 An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,63%	28 Agt 2026
CVE-2026-38093 file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStrea...	3.3 Low	—	0,16%	28 Agt 2026
CVE-2026-37751 An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary comm...	9.8 Critical	—	2,9%	28 Agt 2026
CVE-2026-37736 An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,49%	28 Agt 2026
CVE-2026-37710 Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function	6.1 Medium	—	0,50%	28 Agt 2026
CVE-2026-37237 vllm vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image func...	7.5 High	—	0,73%	28 Agt 2026
CVE-2026-37236 grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allo...	9.8 Critical	—	0,43%	28 Agt 2026
CVE-2026-19412 This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical ac...	8.7 High	—	0,30%	28 Agt 2026
CVE-2026-15603 morgan project morgan morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode lin...	5.3 Medium	—	0,40%	28 Agt 2026
CVE-2026-13761 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service...	8.8 High	—	0,43%	28 Agt 2026
CVE-2026-82261 sveltekit SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserializatio...	7.5 High	—	0,49%	28 Agt 2026
CVE-2026-82260 sveltekit SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vu...	7.5 High	—	0,49%	28 Agt 2026
CVE-2026-82259 sveltekit SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application en...	7.5 High	—	0,53%	28 Agt 2026
CVE-2026-82258 sveltekit SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request...	4.8 Medium	—	0,24%	28 Agt 2026
CVE-2026-82257 sveltekit SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path na...	4.3 Medium	—	0,36%	28 Agt 2026
CVE-2026-82256 sveltekit SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated ex...	5.3 Medium	—	0,42%	28 Agt 2026
CVE-2026-82255 gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers...	6.8 Medium	—	0,38%	28 Agt 2026
CVE-2026-82254 gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can sen...	7.5 High	—	0,49%	28 Agt 2026
CVE-2026-82253 gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only check...	7.5 High	—	0,66%	28 Agt 2026
CVE-2026-82252 gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attacker...	7.5 High	—	0,52%	28 Agt 2026
CVE-2026-82251 gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can cr...	7.5 High	—	0,52%	28 Agt 2026
CVE-2026-82250 gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty p...	6.5 Medium	—	0,43%	28 Agt 2026
CVE-2026-82249 gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns...	3.1 Low	—	0,27%	28 Agt 2026
CVE-2026-82248 gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal syml...	5.3 Medium	—	0,34%	28 Agt 2026
CVE-2026-82247 gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC...	7.5 High	—	0,41%	28 Agt 2026
CVE-2026-82246 Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching...	7.1 High	—	0,22%	28 Agt 2026
CVE-2026-82245 Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate off...	8.1 High	—	0,40%	28 Agt 2026
CVE-2026-82244 Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by upload...	9.1 Critical	—	0,89%	28 Agt 2026
CVE-2026-82243 Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary U...	7.6 High	—	0,30%	28 Agt 2026
CVE-2026-82242 Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject t...	7.7 High	—	0,36%	28 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.