Katalog CVE (hal. 589)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.973 (Critical 36.402 · High 105.447 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.401–29.450 dari 263.973 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18100 The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf_form_id' Widget Se...	6.4 Medium	—	0,38%	25 Agt 2026
CVE-2026-16601 The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and i...	8.8 High	—	1,2%	25 Agt 2026
CVE-2026-78656 A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argumen...	6.3 Medium	—	0,33%	25 Agt 2026
CVE-2026-69665 SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows...	8.5 High	—	0,16%	25 Agt 2026
CVE-2026-68960 A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Window...	5.8 Medium	—	0,61%	25 Agt 2026
CVE-2026-68959 SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on whi...	5.8 Medium	—	0,65%	25 Agt 2026
CVE-2026-68062 SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on whi...	5.8 Medium	—	0,65%	25 Agt 2026
CVE-2026-66109 A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows sy...	8.5 High	—	0,16%	25 Agt 2026
CVE-2026-78654 A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulati...	7.3 High	—	0,71%	25 Agt 2026
CVE-2026-78638 A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Ex...	3.3 Low	—	0,17%	25 Agt 2026
CVE-2026-78478 The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to incl...	8.1 High	—	0,79%	25 Agt 2026
CVE-2026-78470 The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user suppli...	6.5 Medium	—	0,38%	25 Agt 2026
CVE-2026-78637 A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdf...	7.3 High	—	0,40%	25 Agt 2026
CVE-2026-13215 The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem. ext2_verify_disk_superblock() in subs...	6.8 Medium	—	0,28%	25 Agt 2026
CVE-2026-13214 The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central s...	9.8 Critical	—	0,90%	25 Agt 2026
CVE-2026-12561 The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to and including 5.4.5. This is due...	6.4 Medium	—	0,28%	25 Agt 2026
CVE-2026-76063 The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all ve...	6.4 Medium	—	0,35%	25 Agt 2026
CVE-2026-75930 The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to...	4.3 Medium	—	0,37%	25 Agt 2026
CVE-2026-19943 The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all vers...	6.4 Medium	—	0,35%	25 Agt 2026
CVE-2026-19892 The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing...	8.8 High	—	0,44%	25 Agt 2026
CVE-2026-17089 The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in all...	6.1 Medium	—	0,50%	25 Agt 2026
CVE-2026-14280 The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via t...	6.6 Medium	—	1,2%	25 Agt 2026
CVE-2026-78685 Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via...	8.8 High	—	0,64%	25 Agt 2026
CVE-2026-75982 The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_c...	4.4 Medium	—	0,38%	25 Agt 2026
CVE-2026-75019 The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via...	6.4 Medium	—	0,35%	25 Agt 2026
CVE-2026-10627 The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This i...	5.3 Medium	—	0,58%	25 Agt 2026
CVE-2025-9878 The PPWP – Password Protect WordPress \| #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortco...	6.4 Medium	—	0,33%	25 Agt 2026
CVE-2026-78683 nltk NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser...	9.6 Critical	—	0,51%	25 Agt 2026
CVE-2026-78682 nltk NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) wh...	7.5 High	—	0,44%	25 Agt 2026
CVE-2026-78681 nltk NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payload...	7.5 High	—	0,52%	25 Agt 2026
CVE-2026-78680 NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing att...	7.8 High	—	0,18%	25 Agt 2026
CVE-2026-78679 GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. At...	6.5 Medium	—	0,32%	25 Agt 2026
CVE-2026-78678 gitpython project gitpython GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read...	6.5 Medium	—	0,41%	25 Agt 2026
CVE-2026-78677 gitpython project gitpython GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destinat...	7.5 High	—	0,65%	25 Agt 2026
CVE-2026-78676 gitpython project gitpython GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like...	9.8 Critical	—	0,78%	25 Agt 2026
CVE-2026-78675 gitpython project gitpython GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via...	7.8 High	—	0,18%	25 Agt 2026
CVE-2026-76846 Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with pa...	7.5 High	—	0,31%	25 Agt 2026
CVE-2026-76839 Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering....	6.5 Medium	—	0,34%	25 Agt 2026
CVE-2026-75575 Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is rea...	5.3 Medium	—	0,40%	25 Agt 2026
CVE-2026-75574 The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remo...	8.8 High	—	0,66%	25 Agt 2026
CVE-2026-72702 Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchor...	5.4 Medium	—	0,15%	25 Agt 2026
CVE-2026-72701 Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals(...	3.7 Low	—	0,22%	25 Agt 2026
CVE-2026-72700 The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string compa...	7.5 High	—	0,43%	25 Agt 2026
CVE-2026-72699 The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct ex...	5.3 Medium	—	0,26%	25 Agt 2026
CVE-2026-72698 Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration va...	6.5 Medium	—	0,41%	25 Agt 2026
CVE-2026-72697 Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated user...	6.5 Medium	—	0,38%	25 Agt 2026
CVE-2026-72696 Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creat...	8.4 High	—	0,20%	25 Agt 2026
CVE-2026-72695 Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete a...	8.1 High	—	0,63%	25 Agt 2026
CVE-2026-56710 Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.wr...	9.8 Critical	—	0,51%	25 Agt 2026
CVE-2026-56709 Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulat...	7.5 High	—	0,43%	25 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.