Katalog CVE (hal. 590)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.973 (Critical 36.402 · High 105.447 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.451–29.500 dari 263.973 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-56708 Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebindin...	5.3 Medium	—	0,28%	25 Agt 2026
CVE-2026-56707 Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access...	7.7 High	—	0,38%	25 Agt 2026
CVE-2026-56706 Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing anyone who ob...	6.8 Medium	—	0,41%	25 Agt 2026
CVE-2026-56705 Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons....	9.8 Critical	—	0,90%	25 Agt 2026
CVE-2026-56704 Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue M...	6.1 Medium	—	0,34%	25 Agt 2026
CVE-2026-56703 Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated a...	7.2 High	—	1,2%	25 Agt 2026
CVE-2026-56702 Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exp...	8.8 High	—	0,62%	25 Agt 2026
CVE-2026-34968 Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletio...	8.1 High	—	0,53%	25 Agt 2026
CVE-2026-34967 Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenti...	5.4 Medium	—	0,33%	25 Agt 2026
CVE-2026-34964 Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged...	5.8 Medium	—	0,43%	25 Agt 2026
CVE-2026-34959 Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of the prefix v...	4.7 Medium	—	0,29%	25 Agt 2026
CVE-2026-19801 The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to,...	4.3 Medium	—	0,40%	25 Agt 2026
CVE-2026-16434 Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstra...	2.3 Low	—	0,39%	25 Agt 2026
CVE-2026-15023 The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta_key' via Event/Location Duplicate...	6.5 Medium	—	0,57%	25 Agt 2026
CVE-2026-10630 The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference...	4.3 Medium	—	0,46%	25 Agt 2026
CVE-2026-66766 SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could sup...	7.5 High	—	0,51%	25 Agt 2026
CVE-2026-59183 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.10, 3.3.0 th...	5.5 Medium	—	0,17%	25 Agt 2026
CVE-2026-55373 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4....	6.2 Medium	—	0,16%	25 Agt 2026
CVE-2026-55371 OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 thr...	6.9 Medium	—	0,17%	25 Agt 2026
CVE-2026-55059 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.1...	6.1 Medium	—	0,15%	25 Agt 2026
CVE-2026-53532 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafte...	7.1 High	—	0,45%	24 Agt 2026
CVE-2026-78435 A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of th...	3.8 Low	—	0,51%	24 Agt 2026
CVE-2026-78434 A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpdesk/FormCont...	6.5 Medium	—	0,72%	24 Agt 2026
CVE-2026-78284 Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.	8.6 High	—	0,53%	24 Agt 2026
CVE-2026-78282 Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.	7.1 High	—	0,25%	24 Agt 2026
CVE-2026-78268 Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.	7.5 High	—	0,42%	24 Agt 2026
CVE-2026-78267 Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.	9.8 Critical	—	0,48%	24 Agt 2026
CVE-2026-78266 Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.	6.5 Medium	—	0,30%	24 Agt 2026
CVE-2026-78265 Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.	9.8 Critical	—	0,56%	24 Agt 2026
CVE-2026-78264 Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.	7.1 High	—	0,25%	24 Agt 2026
CVE-2026-78263 Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.	7.1 High	—	0,25%	24 Agt 2026
CVE-2026-78262 Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.	9.8 Critical	—	0,56%	24 Agt 2026
CVE-2026-78259 Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.	7.3 High	—	0,38%	24 Agt 2026
CVE-2026-77384 libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimea...	7.5 High	—	0,61%	24 Agt 2026
CVE-2026-77337 CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and fr...	9.1 Critical	—	0,70%	24 Agt 2026
CVE-2026-68516 OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a craft...	6.5 Medium	—	0,45%	24 Agt 2026
CVE-2026-45404 OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggag...	5.9 Medium	—	0,14%	24 Agt 2026
CVE-2026-32563 Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.	9.8 Critical	—	0,56%	24 Agt 2026
CVE-2026-32561 Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.	8.8 High	—	0,42%	24 Agt 2026
CVE-2026-32560 Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.	8.8 High	—	0,46%	24 Agt 2026
CVE-2026-32559 Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.	9.9 Critical	—	0,48%	24 Agt 2026
CVE-2026-32556 Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.	7.1 High	—	0,25%	24 Agt 2026
CVE-2026-32555 Unauthenticated SQL Injection in Boost <= 2.0.4 versions.	9.3 Critical	—	0,40%	24 Agt 2026
CVE-2026-32554 Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.	9.3 Critical	—	0,40%	24 Agt 2026
CVE-2026-27364 Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.	6.5 Medium	—	0,30%	24 Agt 2026
CVE-2026-17113 A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `serv...	6.0 Medium	—	0,15%	24 Agt 2026
CVE-2026-7455 autodesk 3ds max A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to...	7.8 High	—	0,19%	24 Agt 2026
CVE-2026-77635 CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with Postgr...	9.2 Critical	—	0,49%	24 Agt 2026
CVE-2026-77634 CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added w...	8.2 High	—	0,54%	24 Agt 2026
CVE-2026-77567 Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handlin...	8.1 High	—	0,55%	24 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.