Katalog CVE (hal. 622)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.331 (Critical 36.436 · High 105.591 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 28 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.051–31.100 dari 264.331 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73197 redhat enterprise linux, freeipa A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py...	7.5 High	—	0,54%	20 Agt 2026
CVE-2026-73196 redhat enterprise linux, freeipa A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversize...	6.5 Medium	—	0,43%	20 Agt 2026
CVE-2026-13097 redhat enterprise linux, freeipa A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properl...	8.7 High	—	0,75%	20 Agt 2026
CVE-2026-11861 freeipa, redhat enterprise linux A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA se...	8.1 High	—	0,35%	20 Agt 2026
CVE-2026-18917 A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted valu...	7.8 High	—	0,18%	20 Agt 2026
CVE-2026-77014 A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-...	5.3 Medium	—	0,23%	20 Agt 2026
CVE-2026-76610 Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modific...	6.9 Medium	—	0,22%	20 Agt 2026
CVE-2026-14953 A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.	4.3 Medium	—	0,33%	20 Agt 2026
CVE-2026-14952 An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads...	7.5 High	—	0,54%	20 Agt 2026
CVE-2026-14951 An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages.	8.0 High	—	0,23%	20 Agt 2026
CVE-2026-14950 An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk...	9.8 Critical	—	0,65%	20 Agt 2026
CVE-2026-14949 A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts wit...	6.5 Medium	—	0,37%	20 Agt 2026
CVE-2026-14948 A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session ident...	8.8 High	—	0,57%	20 Agt 2026
CVE-2026-14947 A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and w...	7.2 High	—	1,5%	20 Agt 2026
CVE-2026-14946 A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to achieve arbitrary code execution due to improper fil...	7.2 High	—	0,76%	20 Agt 2026
CVE-2026-76569 Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4	5.3 Medium	—	0,44%	20 Agt 2026
CVE-2026-76565 Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7	5.3 Medium	—	0,44%	20 Agt 2026
CVE-2026-76564 Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7	8.6 High	—	0,44%	20 Agt 2026
CVE-2026-75948 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw...	8.6 High	—	0,39%	20 Agt 2026
CVE-2025-14601 An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insu...	8.6 High	—	1,1%	20 Agt 2026
CVE-2026-71368 F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed.	5.1 Medium	—	0,26%	20 Agt 2026
CVE-2026-14163 octopus server In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.	7.5 High	—	0,38%	20 Agt 2026
CVE-2025-14602 The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or bru...	5.3 Medium	—	0,47%	20 Agt 2026
CVE-2026-75963 The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template functio...	7.5 High	—	0,87%	20 Agt 2026
CVE-2026-75860 The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is availab...	9.8 Critical	—	0,50%	20 Agt 2026
CVE-2026-74992 The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwant...	6.8 Medium	—	0,43%	20 Agt 2026
CVE-2026-73542 Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by...	3.7 Low	—	0,18%	20 Agt 2026
CVE-2026-19699 The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and ab...	2.7 Low	—	0,30%	20 Agt 2026
CVE-2026-19697 The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, su...	6.8 Medium	—	0,43%	20 Agt 2026
CVE-2026-19615 The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a rol...	6.8 Medium	—	0,43%	20 Agt 2026
CVE-2026-17153 The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly...	5.3 Medium	—	0,46%	20 Agt 2026
CVE-2026-15049 The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malform...	7.2 High	—	0,76%	20 Agt 2026
CVE-2026-13405 The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allo...	6.6 Medium	—	0,38%	20 Agt 2026
CVE-2026-76957 libexpat project libexpat libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-202...	7.8 High	—	0,11%	20 Agt 2026
CVE-2026-76956 libexpat project libexpat In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding...	7.5 High	—	0,29%	20 Agt 2026
CVE-2026-76800 A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a manipulation...	6.3 Medium	—	0,35%	20 Agt 2026
CVE-2026-76799 A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registration_syste...	5.3 Medium	—	0,53%	20 Agt 2026
CVE-2026-76795 A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of th...	7.3 High	—	0,61%	20 Agt 2026
CVE-2026-76785 A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/mode...	6.3 Medium	—	0,33%	20 Agt 2026
CVE-2026-76783 A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the ar...	7.3 High	—	0,41%	20 Agt 2026
CVE-2026-75628 Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parame...	5.7 Medium	—	0,50%	20 Agt 2026
CVE-2026-8619 tp-link tl-mr100 firmware, tp-link archer mr600 firmware +2 lainnya An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of...	7.5 High	—	0,87%	20 Agt 2026
CVE-2026-76764 A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admi...	7.3 High	—	0,43%	20 Agt 2026
CVE-2026-76762 A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation of the arg...	7.3 High	—	0,43%	20 Agt 2026
CVE-2022-4996 A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can lead to floating point comparison with incorrect op...	5.3 Medium	—	0,64%	20 Agt 2026
CVE-2026-76929 wireshark Pcapng file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service	5.5 Medium	—	0,13%	19 Agt 2026
CVE-2026-76928 wireshark X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service	7.5 High	—	0,32%	19 Agt 2026
CVE-2026-76927 wireshark H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service	7.5 High	—	0,18%	19 Agt 2026
CVE-2026-76926 wireshark BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service	6.5 Medium	—	0,22%	19 Agt 2026
CVE-2026-76924 wireshark Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service	5.5 Medium	—	0,14%	19 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.