Katalog CVE (hal. 563)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.391 (Critical 36.349 · High 105.294 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 26 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 28.101–28.150 dari 263.391 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-19760 The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including,...	7.2 High	—	0,42%	26 Agt 2026
CVE-2026-19718 The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plu...	8.1 High	—	0,38%	26 Agt 2026
CVE-2026-19226 The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow...	6.8 Medium	—	0,43%	26 Agt 2026
CVE-2026-19220 The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthentica...	3.7 Low	—	0,24%	26 Agt 2026
CVE-2026-19094 The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowi...	5.3 Medium	—	0,36%	26 Agt 2026
CVE-2026-16986 The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from at...	5.3 Medium	—	0,30%	26 Agt 2026
CVE-2026-16984 The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check...	6.5 Medium	—	0,35%	26 Agt 2026
CVE-2026-15203 Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to int...	9.3 Critical	—	0,48%	26 Agt 2026
CVE-2026-14550 The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available n...	5.3 Medium	—	0,34%	26 Agt 2026
CVE-2026-14216 The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing...	6.5 Medium	—	0,43%	26 Agt 2026
CVE-2026-14212 The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being up...	4.7 Medium	—	0,29%	26 Agt 2026
CVE-2026-13406 The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, call...	5.3 Medium	—	0,32%	26 Agt 2026
CVE-2026-13404 The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before w...	5.3 Medium	—	0,30%	26 Agt 2026
CVE-2026-13172 The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthent...	5.3 Medium	—	0,32%	26 Agt 2026
CVE-2026-9805 SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow.	2.7 Low	—	0,13%	26 Agt 2026
CVE-2026-80214 LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.	8.6 High	—	0,54%	26 Agt 2026
CVE-2026-80202 Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a re...	8.8 High	—	0,39%	26 Agt 2026
CVE-2026-80201 Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Atta...	2.0 Low	—	0,23%	26 Agt 2026
CVE-2026-80200 Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect des...	4.7 Medium	—	0,36%	26 Agt 2026
CVE-2026-80199 Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header...	3.7 Low	—	0,31%	26 Agt 2026
CVE-2026-80198 Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configurat...	7.5 High	—	0,43%	26 Agt 2026
CVE-2026-80197 Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate othe...	4.3 Medium	—	0,26%	26 Agt 2026
CVE-2026-80196 Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers...	7.5 High	—	0,48%	26 Agt 2026
CVE-2026-80195 Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing t...	5.4 Medium	—	0,36%	26 Agt 2026
CVE-2026-80194 Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization guards are at...	4.3 Medium	—	0,31%	26 Agt 2026
CVE-2026-80193 Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_tim...	8.8 High	—	0,47%	26 Agt 2026
CVE-2026-80192 @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain veri...	8.1 High	—	0,36%	26 Agt 2026
CVE-2026-80191 GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/s...	7.5 High	—	0,48%	26 Agt 2026
CVE-2026-80189 LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens each entry a...	6.5 Medium	—	0,55%	26 Agt 2026
CVE-2026-76149 CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.	4.6 Medium	—	0,15%	26 Agt 2026
CVE-2026-76148 CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.	8.4 High	—	0,24%	26 Agt 2026
CVE-2026-73335 Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Andro...	4.6 Medium	—	0,14%	26 Agt 2026
CVE-2026-58092 freebsd In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing...	8.1 High	—	0,35%	26 Agt 2026
CVE-2026-58091 freebsd The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sl...	7.8 High	—	0,15%	26 Agt 2026
CVE-2026-58090 freebsd The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths wo...	7.8 High	—	0,15%	26 Agt 2026
CVE-2026-58089 freebsd When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that thi...	7.8 High	—	0,14%	26 Agt 2026
CVE-2026-57171 Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, th...	7.7 High	—	0,22%	26 Agt 2026
CVE-2026-57170 Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custo...	7.8 High	—	0,24%	26 Agt 2026
CVE-2026-54467 On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.	7.0 High	—	0,17%	26 Agt 2026
CVE-2026-52776 Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator t...	8.6 High	—	0,44%	26 Agt 2026
CVE-2026-29988 A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an...	7.6 High	—	0,17%	26 Agt 2026
CVE-2026-19632 The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl...	9.8 Critical	—	4,5%	26 Agt 2026
CVE-2026-80138 ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can subm...	9.8 Critical	—	1,2%	25 Agt 2026
CVE-2026-79912 A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a...	8.3 High	—	2,1%	25 Agt 2026
CVE-2026-79911 A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi...	10.0 Critical	—	1,1%	25 Agt 2026
CVE-2026-70665 Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registrati...	4.2 Medium	—	0,26%	25 Agt 2026
CVE-2026-55805 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core...	5.4 Medium	—	0,23%	25 Agt 2026
CVE-2026-54757 Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Tr...	7.8 High	—	0,36%	25 Agt 2026
CVE-2026-44476 Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information...	6.3 Medium	—	0,56%	25 Agt 2026
CVE-2026-41707 vmware spring security Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack v...	7.4 High	—	0,39%	25 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.