Katalog CVE (hal. 604)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.125 (Critical 36.415 · High 105.508 · KEV 1.758 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 30.151–30.200 dari 264.125 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-19221 The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on...	7.2 High	—	0,67%	22 Agt 2026
CVE-2026-19093 The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitra...	6.8 Medium	—	0,46%	22 Agt 2026
CVE-2026-18052 The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used logi...	8.1 High	—	0,37%	22 Agt 2026
CVE-2026-16738 The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payme...	5.3 Medium	—	0,33%	22 Agt 2026
CVE-2026-16612 The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated...	5.3 Medium	—	0,35%	22 Agt 2026
CVE-2026-16260 The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML...	6.8 Medium	—	0,43%	22 Agt 2026
CVE-2026-14187 The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read t...	2.7 Low	—	0,30%	22 Agt 2026
CVE-2026-76074 The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all...	4.3 Medium	—	0,40%	22 Agt 2026
CVE-2026-76057 The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all...	4.3 Medium	—	0,44%	22 Agt 2026
CVE-2026-75027 The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifyi...	5.3 Medium	—	0,56%	22 Agt 2026
CVE-2026-19883 The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability c...	8.8 High	—	0,69%	22 Agt 2026
CVE-2026-77781 Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malfo...	7.5 High	—	0,61%	22 Agt 2026
CVE-2026-53541 OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments...	4.3 Medium	—	0,38%	21 Agt 2026
CVE-2026-53525 WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string compari...	7.4 High	—	0,43%	21 Agt 2026
CVE-2026-53524 WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression...	6.5 Medium	—	0,48%	21 Agt 2026
CVE-2026-53499 FORT Validator is a Resource Public Key Infrastructure (RPKI) relying-party validator that produces validated route-origin data. FORT Validator versions through 1.6.7 con...	7.2 High	—	0,20%	21 Agt 2026
CVE-2026-49360 Recce is a data-validation toolkit for enhanced dbt (data build tool) PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted ne...	7.8 High	—	1,1%	21 Agt 2026
CVE-2026-48106 Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/re...	8.3 High	—	0,22%	21 Agt 2026
CVE-2026-48105 Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`) acce...	8.3 High	—	0,22%	21 Agt 2026
CVE-2026-48050 Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.Ne...	8.8 High	—	0,64%	21 Agt 2026
CVE-2026-47735 Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked onl...	7.1 High	—	0,43%	21 Agt 2026
CVE-2026-34949 Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during t...	6.5 Medium	—	0,37%	21 Agt 2026
CVE-2026-34948 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This iss...	7.7 High	—	0,39%	21 Agt 2026
CVE-2026-53531 RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per...	6.9 Medium	—	0,43%	21 Agt 2026
CVE-2026-53530 RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte...	8.7 High	—	0,43%	21 Agt 2026
CVE-2026-53529 LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or admin...	4.8 Medium	—	0,39%	21 Agt 2026
CVE-2026-53528 LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with edi...	8.8 High	—	0,55%	21 Agt 2026
CVE-2026-53527 LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their o...	8.8 High	—	0,42%	21 Agt 2026
CVE-2026-53509 CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that ac...	5.7 Medium	—	0,38%	21 Agt 2026
CVE-2026-53497 CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array,...	5.3 Medium	—	0,40%	21 Agt 2026
CVE-2026-53487 Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permi...	4.3 Medium	—	0,27%	21 Agt 2026
CVE-2026-53468 Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTM...	4.6 Medium	—	0,24%	21 Agt 2026
CVE-2026-49849 xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload execut...	9.1 Critical	—	0,99%	21 Agt 2026
CVE-2026-43980 Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received...	6.3 Medium	—	0,33%	21 Agt 2026
CVE-2026-34836 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access withou...	6.5 Medium	—	0,39%	21 Agt 2026
CVE-2026-34741 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from...	8.6 High	—	0,64%	21 Agt 2026
CVE-2026-33333 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in vers...	3.5 Low	—	0,28%	21 Agt 2026
CVE-2026-33240 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria...	8.8 High	—	0,47%	21 Agt 2026
CVE-2026-33047 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed...	4.3 Medium	—	0,37%	21 Agt 2026
CVE-2026-31936 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has b...	8.8 High	—	0,48%	21 Agt 2026
CVE-2026-77811 Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboar...	8.7 High	—	0,52%	21 Agt 2026
CVE-2026-77415 JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbi...	9.3 Critical	—	0,89%	21 Agt 2026
CVE-2026-77414 JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Craf...	9.3 Critical	—	0,57%	21 Agt 2026
CVE-2026-77413 JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and al...	9.3 Critical	—	0,72%	21 Agt 2026
CVE-2026-77354 kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker...	8.7 High	—	0,52%	21 Agt 2026
CVE-2026-77220 PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document di...	6.5 Medium	—	0,42%	21 Agt 2026
CVE-2026-77219 GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image wi...	7.1 High	—	0,13%	21 Agt 2026
CVE-2026-76905 kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go derefere...	7.5 High	—	0,61%	21 Agt 2026
CVE-2026-76904 GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vul...	9.8 Critical	—	4,0%	21 Agt 2026
CVE-2026-69238 esri portal for arcgis There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into...	4.8 Medium	—	0,24%	21 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.