Katalog CVE (hal. 572)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.917 (Critical 36.380 · High 105.432 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 12:31 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 28.551–28.600 dari 263.917 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-77548 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a C...	9.9 Critical	—	1,4%	26 Agt 2026
CVE-2026-77547 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Co...	9.9 Critical	—	1,4%	26 Agt 2026
CVE-2026-77546 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Co...	9.9 Critical	—	1,4%	26 Agt 2026
CVE-2026-77532 A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code...	8.8 High	—	0,27%	26 Agt 2026
CVE-2026-5092 The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, a...	6.4 Medium	—	0,36%	26 Agt 2026
CVE-2026-3235 The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function...	5.3 Medium	—	0,40%	26 Agt 2026
CVE-2026-18080 The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and includin...	9.8 Critical	—	0,87%	26 Agt 2026
CVE-2026-80350 OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range....	7.1 High	—	0,40%	26 Agt 2026
CVE-2026-80349 TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream...	9.8 Critical	—	0,68%	26 Agt 2026
CVE-2026-80348 TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no...	8.8 High	—	0,57%	26 Agt 2026
CVE-2026-80347 mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, whic...	7.5 High	—	0,35%	26 Agt 2026
CVE-2026-80346 StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into A...	7.1 High	—	0,53%	26 Agt 2026
CVE-2026-77545 A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices runnin...	9.0 Critical	—	0,39%	26 Agt 2026
CVE-2026-77543 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Co...	9.9 Critical	—	1,4%	26 Agt 2026
CVE-2026-77542 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Comma...	9.1 Critical	—	1,3%	26 Agt 2026
CVE-2026-77541 A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate pri...	9.1 Critical	—	0,46%	26 Agt 2026
CVE-2026-77540 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command In...	9.1 Critical	—	1,3%	26 Agt 2026
CVE-2026-77539 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command In...	9.1 Critical	—	1,3%	26 Agt 2026
CVE-2026-77538 A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges within the U...	8.2 High	—	0,39%	26 Agt 2026
CVE-2026-77537 A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on...	10.0 Critical	—	1,6%	26 Agt 2026
CVE-2026-77536 A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escala...	9.9 Critical	—	0,42%	26 Agt 2026
CVE-2026-77535 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a...	9.1 Critical	—	1,3%	26 Agt 2026
CVE-2026-77534 A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escala...	9.9 Critical	—	0,47%	26 Agt 2026
CVE-2026-59683 The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system...	9.8 Critical	—	0,55%	26 Agt 2026
CVE-2026-59682 Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.	9.1 Critical	—	0,50%	26 Agt 2026
CVE-2026-2388 The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the w...	6.4 Medium	—	0,41%	26 Agt 2026
CVE-2026-19042 A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the cont...	8.8 High	—	1,8%	26 Agt 2026
CVE-2026-18794 The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.	8.2 High	—	0,43%	26 Agt 2026
CVE-2026-16444 Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files...	7.5 High	—	0,41%	26 Agt 2026
CVE-2026-80237 EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, th...	8.8 High	—	0,79%	26 Agt 2026
CVE-2026-80236 Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read databas...	8.2 High	—	0,48%	26 Agt 2026
CVE-2026-80235 EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors,...	9.8 Critical	—	0,90%	26 Agt 2026
CVE-2026-80234 CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specif...	5.3 Medium	—	0,50%	26 Agt 2026
CVE-2026-80233 CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execut...	7.2 High	—	0,82%	26 Agt 2026
CVE-2026-77533 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a C...	9.9 Critical	—	1,4%	26 Agt 2026
CVE-2026-19538 nlnetlabs nsd The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and send...	7.5 High	—	0,44%	26 Agt 2026
CVE-2026-19401 nlnetlabs nsd Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie optio...	7.5 High	—	0,46%	26 Agt 2026
CVE-2026-19197 A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapsho...	6.3 Medium	—	0,15%	26 Agt 2026
CVE-2026-18916 nlnetlabs nsd Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can de...	7.5 High	—	0,46%	26 Agt 2026
CVE-2026-18664 nlnetlabs nsd When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that...	9.1 Critical	—	0,44%	26 Agt 2026
CVE-2026-9668 With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly....	6.3 Medium	—	0,79%	26 Agt 2026
CVE-2026-78237 Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained eff...	7.8 High	—	0,15%	26 Agt 2026
CVE-2026-78236 An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) w...	8.8 High	—	0,10%	26 Agt 2026
CVE-2026-75977 The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due t...	8.8 High	—	0,87%	26 Agt 2026
CVE-2026-6178 The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insu...	6.4 Medium	—	0,36%	26 Agt 2026
CVE-2026-18884 The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2....	7.5 High	—	0,54%	26 Agt 2026
CVE-2026-58108 The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an im...	1.2 Low	—	0,30%	26 Agt 2026
CVE-2026-3002 The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all version...	6.4 Medium	—	0,35%	26 Agt 2026
CVE-2026-18431 Advisory The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in v...	9.8 Critical	—	0,90%	26 Agt 2026
CVE-2026-18331 The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fr...	7.2 High	—	0,49%	26 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.