Katalog CVE (hal. 573)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.917 (Critical 36.380 · High 105.432 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 12:31 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 28.601–28.650 dari 263.917 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page	2.4 Low	—	0,23%	26 Agt 2026
CVE-2026-15365 A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.	2.4 Low	—	0,24%	26 Agt 2026
CVE-2026-79654 A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticat...	4.3 Medium	—	0,38%	26 Agt 2026
CVE-2026-78146 The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscribe...	6.5 Medium	—	0,29%	26 Agt 2026
CVE-2026-77790 The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users...	5.5 Medium	—	0,27%	26 Agt 2026
CVE-2026-77789 The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal...	4.3 Medium	—	0,25%	26 Agt 2026
CVE-2026-77758 The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before...	5.3 Medium	—	0,35%	26 Agt 2026
CVE-2026-77757 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it...	5.4 Medium	—	0,29%	26 Agt 2026
CVE-2026-77754 The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retri...	5.3 Medium	—	0,35%	26 Agt 2026
CVE-2026-77695 The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it expose...	6.5 Medium	—	0,28%	26 Agt 2026
CVE-2026-77694 The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated...	5.3 Medium	—	0,30%	26 Agt 2026
CVE-2026-77693 The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be d...	8.7 High	—	0,45%	26 Agt 2026
CVE-2026-75798 The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out t...	5.3 Medium	—	0,30%	26 Agt 2026
CVE-2026-75797 The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its...	7.7 High	—	0,44%	26 Agt 2026
CVE-2026-74930 The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API rou...	4.3 Medium	—	0,27%	26 Agt 2026
CVE-2026-74929 The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, su...	5.4 Medium	—	0,23%	26 Agt 2026
CVE-2026-74928 The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts...	7.5 High	—	0,40%	26 Agt 2026
CVE-2026-74851 The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and abo...	7.2 High	—	0,67%	26 Agt 2026
CVE-2026-58097 freebsd mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with acces...	7.8 High	—	0,17%	26 Agt 2026
CVE-2026-58096 freebsd LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an ou...	8.8 High	—	0,60%	26 Agt 2026
CVE-2026-58095 freebsd mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global res...	8.8 High	—	0,60%	26 Agt 2026
CVE-2026-58094 freebsd The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, be...	7.8 High	—	0,12%	26 Agt 2026
CVE-2026-58093 freebsd The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the...	7.0 High	—	0,10%	26 Agt 2026
CVE-2026-19760 The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including,...	7.2 High	—	0,42%	26 Agt 2026
CVE-2026-19718 The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plu...	8.1 High	—	0,38%	26 Agt 2026
CVE-2026-19226 The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow...	6.8 Medium	—	0,43%	26 Agt 2026
CVE-2026-19220 The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthentica...	3.7 Low	—	0,24%	26 Agt 2026
CVE-2026-19094 The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowi...	5.3 Medium	—	0,36%	26 Agt 2026
CVE-2026-16986 The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from at...	5.3 Medium	—	0,30%	26 Agt 2026
CVE-2026-16984 The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check...	6.5 Medium	—	0,35%	26 Agt 2026
CVE-2026-15203 Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to int...	9.3 Critical	—	0,48%	26 Agt 2026
CVE-2026-14550 The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available n...	5.3 Medium	—	0,34%	26 Agt 2026
CVE-2026-14216 The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing...	6.5 Medium	—	0,43%	26 Agt 2026
CVE-2026-14212 The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being up...	4.7 Medium	—	0,29%	26 Agt 2026
CVE-2026-13406 The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, call...	5.3 Medium	—	0,32%	26 Agt 2026
CVE-2026-13404 The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before w...	5.3 Medium	—	0,30%	26 Agt 2026
CVE-2026-13172 The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthent...	5.3 Medium	—	0,32%	26 Agt 2026
CVE-2026-9805 SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow.	2.7 Low	—	0,13%	26 Agt 2026
CVE-2026-80214 LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.	8.6 High	—	0,54%	26 Agt 2026
CVE-2026-80202 Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a re...	8.8 High	—	0,39%	26 Agt 2026
CVE-2026-80201 Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Atta...	2.0 Low	—	0,23%	26 Agt 2026
CVE-2026-80200 Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect des...	4.7 Medium	—	0,36%	26 Agt 2026
CVE-2026-80199 Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header...	3.7 Low	—	0,31%	26 Agt 2026
CVE-2026-80198 Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configurat...	7.5 High	—	0,43%	26 Agt 2026
CVE-2026-80197 Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate othe...	4.3 Medium	—	0,26%	26 Agt 2026
CVE-2026-80196 Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers...	7.5 High	—	0,48%	26 Agt 2026
CVE-2026-80195 Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing t...	5.4 Medium	—	0,36%	26 Agt 2026
CVE-2026-80194 Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization guards are at...	4.3 Medium	—	0,31%	26 Agt 2026
CVE-2026-80193 Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_tim...	8.8 High	—	0,47%	26 Agt 2026
CVE-2026-80192 @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain veri...	8.1 High	—	0,36%	26 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.