Katalog CVE (hal. 600)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.125 (Critical 36.415 · High 105.508 · KEV 1.758 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 29.951–30.000 dari 264.125 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-5389 justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can...	6.1 Medium	—	0,23%	23 Agt 2026
CVE-2026-5388 justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (h...	9.8 Critical	—	0,59%	23 Agt 2026
CVE-2026-4671 justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled...	7.5 High	—	0,65%	23 Agt 2026
CVE-2026-78155 ongres stackgres privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges	9.9 Critical	—	0,52%	23 Agt 2026
CVE-2026-78115 A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit_user_account.php of the co...	5.4 Medium	—	0,40%	23 Agt 2026
CVE-2026-78112 A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0. This impacts an unknown function of the file /viewservicetype.php. This manipulation...	6.3 Medium	—	0,33%	23 Agt 2026
CVE-2026-10053 gitlab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions co...	8.8 High	—	0,82%	23 Agt 2026
CVE-2026-77116 Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is en...	4.3 Medium	—	0,27%	23 Agt 2026
CVE-2026-77115 Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.	7.1 High	—	0,25%	23 Agt 2026
CVE-2026-77003 The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contr...	2.7 Low	—	0,28%	23 Agt 2026
CVE-2026-14853 The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the...	4.3 Medium	—	0,28%	23 Agt 2026
CVE-2026-13598 The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new a...	9.8 Critical	—	0,50%	23 Agt 2026
CVE-2026-78063 A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the...	7.4 High	—	2,7%	23 Agt 2026
CVE-2026-78062 A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret...	7.3 High	—	0,50%	23 Agt 2026
CVE-2026-78061 A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email S...	6.3 Medium	—	0,34%	23 Agt 2026
CVE-2026-78060 A vulnerability was found in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /php_action/getOrderReport.php. Performing...	4.3 Medium	—	0,47%	23 Agt 2026
CVE-2026-78059 A vulnerability has been found in SourceCodester Stock Management System 1.0. This vulnerability affects unknown code of the file /php_action/printOrder.php. Such manipul...	4.3 Medium	—	0,47%	23 Agt 2026
CVE-2026-78057 A flaw has been found in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown part of the component Management Muta...	6.3 Medium	—	0,33%	23 Agt 2026
CVE-2026-78056 A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is some unknown functionality o...	6.3 Medium	—	0,33%	23 Agt 2026
CVE-2026-78055 A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file...	4.3 Medium	—	0,47%	23 Agt 2026
CVE-2026-78136 chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.	7.8 High	—	0,21%	23 Agt 2026
CVE-2026-78054 A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /BSIS1.php. Executing a manipulation o...	4.3 Medium	—	0,33%	23 Agt 2026
CVE-2026-78051 A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component...	5.3 Medium	—	0,53%	23 Agt 2026
CVE-2026-78050 A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of...	9.9 Critical	—	0,79%	23 Agt 2026
CVE-2026-18027 The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, a...	6.5 Medium	—	0,87%	23 Agt 2026
CVE-2026-16149 The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin...	8.8 High	—	0,59%	23 Agt 2026
CVE-2026-0551 The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted...	8.8 High	—	0,75%	23 Agt 2026
CVE-2026-78122 docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET r...	7.4 High	—	0,31%	22 Agt 2026
CVE-2026-78049 A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/ClientServer/a...	3.7 Low	—	0,62%	22 Agt 2026
CVE-2026-47895 In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigg...	7.5 High	—	0,42%	22 Agt 2026
CVE-2026-12999 The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fixed airoc_pool for every outbou...	5.3 Medium	—	0,25%	22 Agt 2026
CVE-2026-74733 In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Locking is disabled in the regmap config...	7.8 High	—	0,18%	22 Agt 2026
CVE-2026-74731 In the Linux kernel, the following vulnerability has been resolved: sched_ext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail...	7.8 High	—	0,17%	22 Agt 2026
CVE-2026-74730 In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hi...	9.8 Critical	—	0,51%	22 Agt 2026
CVE-2026-74727 In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by_id ovpn_nl_peer_set_doit() resolves the target p...	9.8 Critical	—	0,65%	22 Agt 2026
CVE-2026-74726 In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bond_alb_monitor() reads pr...	7.3 High	—	0,13%	22 Agt 2026
CVE-2026-74725 In the Linux kernel, the following vulnerability has been resolved: enic: fix tx_hang_reset use-after-free on device removal enic_remove() cancels the reset and change_...	7.8 High	—	0,13%	22 Agt 2026
CVE-2026-74724 In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Sashiko warns that local attacker can modify the p...	7.8 High	—	0,12%	22 Agt 2026
CVE-2026-74723 In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers [BUG] For a crafted btrfs image, the followi...	9.8 Critical	—	0,67%	22 Agt 2026
CVE-2026-74721 In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() Two error paths in amdxdna_insert_...	7.8 High	—	0,17%	22 Agt 2026
CVE-2026-74720 In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_...	7.8 High	—	0,13%	22 Agt 2026
CVE-2026-74717 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, return NULL on create error Tracer creation can fail by returning either NULL o...	7.5 High	—	0,50%	22 Agt 2026
CVE-2026-74715 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs...	7.8 High	—	0,13%	22 Agt 2026
CVE-2026-74714 In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() reqsk_queue_hash_req() publishes a...	7.8 High	—	0,13%	22 Agt 2026
CVE-2026-74713 In the Linux kernel, the following vulnerability has been resolved: vhost_iotlb: bound map allocation in add_range vhost_iotlb_add_range_ctx() only retires an old entry...	7.1 High	—	0,14%	22 Agt 2026
CVE-2026-74712 In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN mess...	9.3 Critical	—	0,14%	22 Agt 2026
CVE-2026-74711 In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix type confusion in notification logic Sashiko reports: At the start of the loop i...	8.4 High	—	0,20%	22 Agt 2026
CVE-2026-74710 In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AF_XDP accepts a TX metadata length as small as eight...	7.8 High	—	0,13%	22 Agt 2026
CVE-2026-74708 In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of st...	7.8 High	—	0,17%	22 Agt 2026
CVE-2026-74707 In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtai...	7.8 High	—	0,18%	22 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.