Katalog CVE (hal. 546)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.383 (Critical 36.349 · High 105.290 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 27.251–27.300 dari 263.383 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-80634 In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG cas...	9.8 Critical	—	0,67%	28 Agt 2026
CVE-2026-80633 In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dma_resv lock before dma_buf_unpin() in release path dma_buf_unpin() requires the call...	8.8 High	—	0,17%	28 Agt 2026
CVE-2026-80631 In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() valid...	7.5 High	—	0,44%	28 Agt 2026
CVE-2026-80630 In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whe...	9.8 Critical	—	0,76%	28 Agt 2026
CVE-2026-80628 In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q->lock snd_seq_oss_readq_clear() resets qlen, head...	7.8 High	—	0,18%	28 Agt 2026
CVE-2026-80622 In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk_cleanup() This patch improves the module cleanup process in...	7.8 High	—	0,17%	28 Agt 2026
CVE-2026-80619 In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aa_replace_profiles The function aa_replace_profiles was accessing ud...	7.8 High	—	0,18%	28 Agt 2026
CVE-2026-80617 In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer but was al...	9.8 Critical	—	0,70%	28 Agt 2026
CVE-2026-80615 In the Linux kernel, the following vulnerability has been resolved: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone kmalloc_flex() in metadata_...	8.2 High	—	0,49%	28 Agt 2026
CVE-2026-80614 In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emac_probe Move devm_request_irq() after devm_platform_io...	7.5 High	—	0,63%	28 Agt 2026
CVE-2026-80613 In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path During XDP enablement in veth, if xdp_rxq_info_reg() or...	7.8 High	—	0,13%	28 Agt 2026
CVE-2026-80612 In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing informat...	9.8 Critical	—	0,55%	28 Agt 2026
CVE-2026-80609 In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe->len_list[] Move index check before element access.	9.8 Critical	—	0,74%	28 Agt 2026
CVE-2026-80608 In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix iommu domain lifetime race during device removal When force_iova mode is enabled,...	8.8 High	—	0,17%	28 Agt 2026
CVE-2026-80606 In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifier_lock for write on inject test path When CONFIG_DRM_XE_USERPTR_INVAL_IN...	7.8 High	—	0,17%	28 Agt 2026
CVE-2026-80604 In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to h...	8.8 High	—	0,41%	28 Agt 2026
CVE-2026-80603 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read parse_dcc() treats data_end as an i...	9.1 Critical	—	0,60%	28 Agt 2026
CVE-2026-80601 In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskb_may_pull() called by batadv_...	8.8 High	—	0,40%	28 Agt 2026
CVE-2026-80600 In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskb_may_pull() called by batadv_g...	9.8 Critical	—	0,73%	28 Agt 2026
CVE-2026-80599 In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto field When batadv_get_vid() accesses the proto fiel...	8.1 High	—	0,42%	28 Agt 2026
CVE-2026-80598 In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompress_lznt decompress_lznt() does not validate array index bou...	7.8 High	—	0,18%	28 Agt 2026
CVE-2026-80596 In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to...	8.4 High	—	0,20%	28 Agt 2026
CVE-2026-80593 In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count before accessing element atk_ec_present() walks the manage...	8.4 High	—	0,20%	28 Agt 2026
CVE-2026-80591 In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before reading its...	7.8 High	—	0,18%	28 Agt 2026
CVE-2026-80590 In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtio_net_hdr (tun/tap, or AF_PACKE...	8.6 High	—	0,58%	28 Agt 2026
CVE-2026-79996 The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who hav...	7.2 High	—	0,46%	28 Agt 2026
CVE-2026-79995 The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user makin...	4.3 Medium	—	0,25%	28 Agt 2026
CVE-2026-79706 The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unaut...	5.3 Medium	—	0,32%	28 Agt 2026
CVE-2026-79615 The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, all...	2.7 Low	—	0,30%	28 Agt 2026
CVE-2026-78238 SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.	4.8 Medium	—	0,24%	28 Agt 2026
CVE-2026-78032 SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.	9.3 Critical	—	0,61%	28 Agt 2026
CVE-2026-77838 SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.	4.8 Medium	—	0,24%	28 Agt 2026
CVE-2026-77701 The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create...	5.3 Medium	—	0,30%	28 Agt 2026
CVE-2026-76581 The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous...	9.8 Critical	—	0,44%	28 Agt 2026
CVE-2026-73827 SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.	4.8 Medium	—	0,24%	28 Agt 2026
CVE-2026-6286 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and...	7.2 High	—	0,62%	28 Agt 2026
CVE-2026-5097 The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient...	7.5 High	—	0,55%	28 Agt 2026
CVE-2026-4246 The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, an...	6.1 Medium	—	0,38%	28 Agt 2026
CVE-2026-40541 An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows...	9.0 Critical	—	0,49%	28 Agt 2026
CVE-2026-19423 The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and scree...	8.1 High	—	0,38%	28 Agt 2026
CVE-2026-19084 The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read ar...	7.5 High	—	0,43%	28 Agt 2026
CVE-2026-14567 The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email...	5.3 Medium	—	0,35%	28 Agt 2026
CVE-2026-14558 The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitte...	7.2 High	—	0,78%	28 Agt 2026
CVE-2026-12514 The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is...	5.3 Medium	—	0,30%	28 Agt 2026
CVE-2026-12513 The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submissi...	6.8 Medium	—	0,38%	28 Agt 2026
CVE-2026-82090 Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...	9.2 Critical	—	0,44%	28 Agt 2026
CVE-2026-82089 The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.	8.8 High	—	0,53%	28 Agt 2026
CVE-2026-82082 NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the s...	9.8 Critical	—	2,0%	28 Agt 2026
CVE-2026-82081 wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.	6.4 Medium	—	0,24%	28 Agt 2026
CVE-2026-77365 The Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a'...	7.2 High	—	0,53%	28 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.