Katalog CVE (hal. 547)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.383 (Critical 36.349 · High 105.290 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 27.301–27.350 dari 263.383 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-76053 The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection in...	7.2 High	—	0,82%	28 Agt 2026
CVE-2026-3129 The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes in all versions up to, and including, 7.7. This i...	6.4 Medium	—	0,33%	28 Agt 2026
CVE-2026-18983 The One User Avatar \| User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_acti...	7.5 High	—	0,87%	28 Agt 2026
CVE-2026-18978 The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient...	7.2 High	—	0,45%	28 Agt 2026
CVE-2026-18324 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in...	7.2 High	—	0,53%	28 Agt 2026
CVE-2026-16759 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versi...	6.5 Medium	—	0,75%	28 Agt 2026
CVE-2026-16654 The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 d...	6.4 Medium	—	0,26%	28 Agt 2026
CVE-2026-15798 The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to in...	6.4 Medium	—	0,41%	28 Agt 2026
CVE-2026-78618 A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a speci...	6.9 Medium	—	0,43%	28 Agt 2026
CVE-2026-78617 WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password...	6.3 Medium	—	0,42%	28 Agt 2026
CVE-2026-78616 A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrar...	4.8 Medium	—	0,30%	28 Agt 2026
CVE-2026-78615 A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated us...	4.6 Medium	—	0,47%	28 Agt 2026
CVE-2026-78614 WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permi...	8.6 High	—	0,71%	28 Agt 2026
CVE-2026-78613 WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permiss...	8.6 High	—	0,62%	28 Agt 2026
CVE-2026-78612 WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration p...	8.6 High	—	0,71%	28 Agt 2026
CVE-2026-78610 WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrat...	8.4 High	—	0,23%	28 Agt 2026
CVE-2026-78500 A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate...	5.1 Medium	—	0,44%	28 Agt 2026
CVE-2026-78499 A server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed net...	5.1 Medium	—	0,44%	28 Agt 2026
CVE-2026-78498 A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed n...	5.1 Medium	—	0,44%	28 Agt 2026
CVE-2026-78495 A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumera...	5.3 Medium	—	0,39%	28 Agt 2026
CVE-2026-78174 WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this l...	9.3 Critical	—	0,43%	28 Agt 2026
CVE-2026-78103 WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workfl...	5.1 Medium	—	0,49%	28 Agt 2026
CVE-2026-78047 A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrar...	5.1 Medium	—	0,44%	28 Agt 2026
CVE-2026-78011 An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VP...	8.7 High	—	0,54%	28 Agt 2026
CVE-2026-78010 A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condi...	8.7 High	—	0,54%	28 Agt 2026
CVE-2026-78009 An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in V...	8.7 High	—	0,54%	28 Agt 2026
CVE-2026-78008 A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (Do...	8.6 High	—	0,61%	28 Agt 2026
CVE-2026-61802 wazuh Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege...	6.5 Medium	—	0,70%	28 Agt 2026
CVE-2026-61800 Advisory wazuh Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding t...	9.1 Critical	—	0,98%	28 Agt 2026
CVE-2026-38822 In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection...	7.6 High	—	2,3%	28 Agt 2026
CVE-2026-38821 A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daem...	7.1 High	—	0,31%	28 Agt 2026
CVE-2026-38820 openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint...	8.3 High	—	2,9%	28 Agt 2026
CVE-2026-38819 Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minute...	5.3 Medium	—	0,26%	28 Agt 2026
CVE-2026-19318 A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending speci...	9.3 Critical	—	0,71%	28 Agt 2026
CVE-2026-19317 An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in V...	8.7 High	—	0,54%	28 Agt 2026
CVE-2026-19316 A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN proce...	8.7 High	—	0,54%	28 Agt 2026
CVE-2026-19315 A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially craft...	9.3 Critical	—	0,70%	28 Agt 2026
CVE-2026-19314 An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VP...	8.7 High	—	0,54%	28 Agt 2026
CVE-2026-19313 An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted...	9.3 Critical	—	0,71%	28 Agt 2026
CVE-2026-13108 WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service.	8.7 High	—	0,43%	28 Agt 2026
CVE-2026-13086 A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthen...	9.3 Critical	—	0,66%	28 Agt 2026
CVE-2026-82072 google chrome Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium...	8.8 High	—	0,41%	28 Agt 2026
CVE-2026-81851 A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of se...	6.9 Medium	—	0,41%	28 Agt 2026
CVE-2026-81848 A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file src/scrapling...	3.5 Low	—	0,35%	28 Agt 2026
CVE-2026-81847 A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save_pipeline/load_pipeline of the file pipeline_tools.py. Pe...	5.5 Medium	—	0,35%	28 Agt 2026
CVE-2026-81845 A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function import_session/export_session of the file mcp_sequential_thinkin...	6.3 Medium	—	0,50%	28 Agt 2026
CVE-2026-81837 A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component Appl...	6.3 Medium	—	0,49%	28 Agt 2026
CVE-2026-81836 A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the compone...	3.7 Low	—	0,28%	28 Agt 2026
CVE-2026-81835 A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the co...	5.5 Medium	—	0,30%	28 Agt 2026
CVE-2026-80179 A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token c...	5.9 Medium	—	0,41%	28 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.