Katalog CVE (hal. 611)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.271 (Critical 36.431 · High 105.570 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 30.501–30.550 dari 264.271 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-77681 A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The m...	6.3 Medium	—	0,37%	21 Agt 2026
CVE-2026-59323 An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when...	5.3 Medium	—	0,40%	21 Agt 2026
CVE-2026-48590 XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/x...	2.1 Low	—	0,23%	21 Agt 2026
CVE-2026-47827 Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities	7.5 High	—	1,6%	21 Agt 2026
CVE-2026-47080 XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/x...	2.1 Low	—	0,22%	21 Agt 2026
CVE-2026-47079 Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulnerability is...	2.1 Low	—	0,19%	21 Agt 2026
CVE-2026-77710 A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatical...	6.9 Medium	—	0,49%	21 Agt 2026
CVE-2026-74866 fastify/busyboy @fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence,...	5.8 Medium	—	0,33%	21 Agt 2026
CVE-2026-68745 apache cloudstack Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the...	8.1 High	—	0,20%	21 Agt 2026
CVE-2026-66797 apache cloudstack Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perfor...	5.4 Medium	—	0,46%	21 Agt 2026
CVE-2026-66722 apache cloudstack Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, a...	7.2 High	—	0,62%	21 Agt 2026
CVE-2026-66721 apache cloudstack Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API...	2.7 Low	—	0,48%	21 Agt 2026
CVE-2026-65613 apache cloudstack Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects...	4.3 Medium	—	0,45%	21 Agt 2026
CVE-2026-63046 apache inlong Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shel...	8.8 High	—	0,68%	21 Agt 2026
CVE-2026-62440 apache cloudstack Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding an...	9.1 Critical	—	0,54%	21 Agt 2026
CVE-2026-61422 apache cloudstack Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes...	4.3 Medium	—	0,42%	21 Agt 2026
CVE-2026-61400 apache cloudstack Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the sys...	8.8 High	—	2,9%	21 Agt 2026
CVE-2026-61399 apache cloudstack Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0...	4.8 Medium	—	0,50%	21 Agt 2026
CVE-2026-61398 apache cloudstack Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack:...	9.1 Critical	—	0,57%	21 Agt 2026
CVE-2026-61397 apache cloudstack Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This issue aff...	7.5 High	—	0,60%	21 Agt 2026
CVE-2026-59799 apache cloudstack Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This i...	8.8 High	—	0,60%	21 Agt 2026
CVE-2026-59780 apache cloudstack Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. LDAP c...	7.5 High	—	0,60%	21 Agt 2026
CVE-2026-59657 apache cloudstack Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. This issue affects Apache CloudStack: from 4.0.0 thr...	7.5 High	—	0,34%	21 Agt 2026
CVE-2026-59655 apache cloudstack Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue aff...	7.5 High	—	0,60%	21 Agt 2026
CVE-2026-59085 apache cloudstack Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache CloudStack:...	9.1 Critical	—	0,59%	21 Agt 2026
CVE-2026-50222 apache cloudstack Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related...	7.5 High	—	0,54%	21 Agt 2026
CVE-2026-50112 apache cloudstack SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. Th...	8.8 High	—	0,72%	21 Agt 2026
CVE-2026-47359 apache cloudstack Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupR...	8.8 High	—	2,0%	21 Agt 2026
CVE-2026-77264 The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to,...	9.8 Critical	—	0,71%	21 Agt 2026
CVE-2026-73537 Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component (WebVie...	5.1 Medium	—	0,29%	21 Agt 2026
CVE-2026-19441 Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082026. NOTE:...	5.3 Medium	—	0,36%	21 Agt 2026
CVE-2026-16323 Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects...	7.5 High	—	0,63%	21 Agt 2026
CVE-2026-75796 The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user manag...	7.2 High	—	0,46%	21 Agt 2026
CVE-2026-19435 The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the conte...	2.7 Low	—	0,32%	21 Agt 2026
CVE-2026-19085 The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to...	2.7 Low	—	0,30%	21 Agt 2026
CVE-2026-18781 The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters...	8.1 High	—	0,54%	21 Agt 2026
CVE-2026-16962 The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a...	5.3 Medium	—	0,30%	21 Agt 2026
CVE-2026-16959 The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query h...	6.8 Medium	—	1,3%	21 Agt 2026
CVE-2026-16577 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's...	2.7 Low	—	0,28%	21 Agt 2026
CVE-2026-16576 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST AP...	7.2 High	—	0,46%	21 Agt 2026
CVE-2026-16575 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returne...	5.3 Medium	—	0,35%	21 Agt 2026
CVE-2026-14601 The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with th...	6.8 Medium	—	0,39%	21 Agt 2026
CVE-2026-14325 The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front...	3.5 Low	—	0,24%	21 Agt 2026
CVE-2026-13736 The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous v...	5.3 Medium	—	0,31%	21 Agt 2026
CVE-2025-15671 The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied re...	5.4 Medium	—	0,31%	21 Agt 2026
CVE-2026-65645 rocket.chat Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid...	4.3 Medium	—	0,34%	21 Agt 2026
CVE-2026-65644 rocket.chat Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an u...	7.5 High	—	0,48%	21 Agt 2026
CVE-2026-45202 Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario caused by m...	5.5 Medium	—	0,14%	21 Agt 2026
CVE-2026-45201 Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages leading to OOB rea...	7.8 High	—	0,16%	21 Agt 2026
CVE-2026-45199 Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memo...	7.8 High	—	0,16%	21 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.