Katalog CVE (hal. 562)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.391 (Critical 36.349 · High 105.294 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 28.051–28.100 dari 263.391 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-59683 The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system...	9.8 Critical	—	0,55%	26 Agt 2026
CVE-2026-59682 Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.	9.1 Critical	—	0,50%	26 Agt 2026
CVE-2026-2388 The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the w...	6.4 Medium	—	0,41%	26 Agt 2026
CVE-2026-19042 A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the cont...	8.8 High	—	1,8%	26 Agt 2026
CVE-2026-18794 The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.	8.2 High	—	0,43%	26 Agt 2026
CVE-2026-16444 Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files...	7.5 High	—	0,41%	26 Agt 2026
CVE-2026-80237 EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, th...	8.8 High	—	0,79%	26 Agt 2026
CVE-2026-80236 Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read databas...	8.2 High	—	0,48%	26 Agt 2026
CVE-2026-80235 EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors,...	9.8 Critical	—	0,90%	26 Agt 2026
CVE-2026-80234 CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specif...	5.3 Medium	—	0,50%	26 Agt 2026
CVE-2026-80233 CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execut...	7.2 High	—	0,82%	26 Agt 2026
CVE-2026-77533 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a C...	9.9 Critical	—	1,4%	26 Agt 2026
CVE-2026-19538 nlnetlabs nsd The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and send...	7.5 High	—	0,44%	26 Agt 2026
CVE-2026-19401 nlnetlabs nsd Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie optio...	7.5 High	—	0,46%	26 Agt 2026
CVE-2026-19197 A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapsho...	6.3 Medium	—	0,15%	26 Agt 2026
CVE-2026-18916 nlnetlabs nsd Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can de...	7.5 High	—	0,46%	26 Agt 2026
CVE-2026-18664 nlnetlabs nsd When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that...	9.1 Critical	—	0,44%	26 Agt 2026
CVE-2026-9668 With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly....	6.3 Medium	—	0,79%	26 Agt 2026
CVE-2026-78237 Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained eff...	7.8 High	—	0,15%	26 Agt 2026
CVE-2026-78236 An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) w...	8.8 High	—	0,10%	26 Agt 2026
CVE-2026-75977 The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due t...	8.8 High	—	0,87%	26 Agt 2026
CVE-2026-6178 The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insu...	6.4 Medium	—	0,36%	26 Agt 2026
CVE-2026-18884 The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2....	7.5 High	—	0,54%	26 Agt 2026
CVE-2026-58108 The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an im...	1.2 Low	—	0,30%	26 Agt 2026
CVE-2026-3002 The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all version...	6.4 Medium	—	0,35%	26 Agt 2026
CVE-2026-18431 Advisory The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in v...	9.8 Critical	—	0,90%	26 Agt 2026
CVE-2026-18331 The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fr...	7.2 High	—	0,49%	26 Agt 2026
CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page	2.4 Low	—	0,23%	26 Agt 2026
CVE-2026-15365 A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.	2.4 Low	—	0,24%	26 Agt 2026
CVE-2026-79654 A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticat...	4.3 Medium	—	0,38%	26 Agt 2026
CVE-2026-78146 The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscribe...	6.5 Medium	—	0,29%	26 Agt 2026
CVE-2026-77790 The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users...	5.5 Medium	—	0,27%	26 Agt 2026
CVE-2026-77789 The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal...	4.3 Medium	—	0,25%	26 Agt 2026
CVE-2026-77758 The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before...	5.3 Medium	—	0,35%	26 Agt 2026
CVE-2026-77757 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it...	5.4 Medium	—	0,29%	26 Agt 2026
CVE-2026-77754 The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retri...	5.3 Medium	—	0,35%	26 Agt 2026
CVE-2026-77695 The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it expose...	6.5 Medium	—	0,28%	26 Agt 2026
CVE-2026-77694 The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated...	5.3 Medium	—	0,30%	26 Agt 2026
CVE-2026-77693 The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be d...	8.7 High	—	0,45%	26 Agt 2026
CVE-2026-75798 The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out t...	5.3 Medium	—	0,30%	26 Agt 2026
CVE-2026-75797 The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its...	7.7 High	—	0,44%	26 Agt 2026
CVE-2026-74930 The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API rou...	4.3 Medium	—	0,27%	26 Agt 2026
CVE-2026-74929 The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, su...	5.4 Medium	—	0,23%	26 Agt 2026
CVE-2026-74928 The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts...	7.5 High	—	0,40%	26 Agt 2026
CVE-2026-74851 The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and abo...	7.2 High	—	0,67%	26 Agt 2026
CVE-2026-58097 freebsd mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with acces...	7.8 High	—	0,17%	26 Agt 2026
CVE-2026-58096 freebsd LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an ou...	8.8 High	—	0,60%	26 Agt 2026
CVE-2026-58095 freebsd mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global res...	8.8 High	—	0,60%	26 Agt 2026
CVE-2026-58094 freebsd The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, be...	7.8 High	—	0,12%	26 Agt 2026
CVE-2026-58093 freebsd The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the...	7.0 High	—	0,10%	26 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.