Katalog CVE (hal. 598)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.125 (Critical 36.415 · High 105.508 · KEV 1.758 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.851–29.900 dari 264.125 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-66587 Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.	9.8 Critical	—	0,50%	24 Agt 2026
CVE-2026-66585 Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.	7.5 High	—	0,42%	24 Agt 2026
CVE-2026-66584 Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.	7.1 High	—	0,25%	24 Agt 2026
CVE-2026-32558 Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.	9.8 Critical	—	0,48%	24 Agt 2026
CVE-2026-32551 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo...	9.3 Critical	—	0,40%	24 Agt 2026
CVE-2026-32478 Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.	8.5 High	—	0,36%	24 Agt 2026
CVE-2026-32477 Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.	8.6 High	—	0,53%	24 Agt 2026
CVE-2026-32476 Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.	7.1 High	—	0,25%	24 Agt 2026
CVE-2026-32471 Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.	8.5 High	—	0,36%	24 Agt 2026
CVE-2026-28190 Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.	7.1 High	—	0,34%	24 Agt 2026
CVE-2026-28171 Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.	8.6 High	—	0,53%	24 Agt 2026
CVE-2026-28167 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects...	7.5 High	—	0,50%	24 Agt 2026
CVE-2026-28166 Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.	7.1 High	—	0,25%	24 Agt 2026
CVE-2026-28165 Unauthenticated Privilege Escalation in Digits <= 9.2 versions.	9.8 Critical	—	0,48%	24 Agt 2026
CVE-2026-28162 Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.	7.1 High	—	0,25%	24 Agt 2026
CVE-2026-28153 Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions.	7.5 High	—	0,43%	24 Agt 2026
CVE-2026-28152 Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.	8.1 High	—	0,47%	24 Agt 2026
CVE-2026-28151 Unauthenticated Local File Inclusion in Tonda < 2.6 versions.	8.1 High	—	0,47%	24 Agt 2026
CVE-2025-63080 Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file r...	8.5 High	—	0,29%	24 Agt 2026
CVE-2026-78337 Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create comp...	4.8 Medium	—	0,40%	24 Agt 2026
CVE-2026-78245 A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Re...	7.3 High	—	0,50%	24 Agt 2026
CVE-2026-78244 A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a...	7.3 High	—	0,43%	24 Agt 2026
CVE-2026-76172 openjsf fast-uri fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes th...	7.5 High	—	0,23%	24 Agt 2026
CVE-2026-59295 It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak. Micrometer...	5.9 Medium	—	0,37%	24 Agt 2026
CVE-2026-10618 gohugo hugo Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/intern...	5.4 Medium	—	0,30%	24 Agt 2026
CVE-2026-10582 Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config...	7.4 High	—	0,44%	24 Agt 2026
CVE-2026-78317 SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.	8.8 High	—	0,66%	24 Agt 2026
CVE-2026-78316 SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.	8.8 High	—	0,66%	24 Agt 2026
CVE-2026-78315 SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.	8.8 High	—	0,66%	24 Agt 2026
CVE-2026-78314 SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.	8.8 High	—	0,66%	24 Agt 2026
CVE-2026-75975 openjsf fast-uri fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority...	7.5 High	—	0,22%	24 Agt 2026
CVE-2026-75931 openjsf fast-uri fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a h...	7.5 High	—	0,40%	24 Agt 2026
CVE-2026-75899 openjsf fast-uri fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recompos...	7.5 High	—	0,22%	24 Agt 2026
CVE-2026-66897 canonical lxd A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwri...	9.9 Critical	—	0,72%	24 Agt 2026
CVE-2026-78321 The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network c...	6.0 Medium	—	0,24%	24 Agt 2026
CVE-2026-78306 DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, includ...	8.5 High	—	0,24%	24 Agt 2026
CVE-2026-78255 The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a pr...	8.7 High	—	0,41%	24 Agt 2026
CVE-2026-77994 Advisory Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue relat...	9.3 Critical	—	0,39%	24 Agt 2026
CVE-2026-77993 Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a reflected XSS via the iscontenttype pa...	5.3 Medium	—	0,44%	24 Agt 2026
CVE-2026-8173 The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MA...	5.3 Medium	—	0,35%	24 Agt 2026
CVE-2026-78202 A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img re...	7.3 High	—	0,50%	24 Agt 2026
CVE-2026-78201 A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argumen...	7.3 High	—	0,43%	24 Agt 2026
CVE-2026-78200 A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of th...	6.3 Medium	—	0,33%	24 Agt 2026
CVE-2026-78199 A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipu...	7.3 High	—	0,43%	24 Agt 2026
CVE-2026-78198 A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/aja...	7.3 High	—	0,43%	24 Agt 2026
CVE-2026-78197 A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.php?action=sa...	7.3 High	—	0,44%	24 Agt 2026
CVE-2026-78196 A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the compone...	4.4 Medium	—	0,17%	24 Agt 2026
CVE-2026-78187 A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang lead...	3.1 Low	—	0,66%	24 Agt 2026
CVE-2026-78186 A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the argument U...	4.3 Medium	—	0,53%	24 Agt 2026
CVE-2026-59561 Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted dir...	8.4 High	—	1,1%	24 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.