Katalog CVE (hal. 639)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.555 (Critical 36.456 · High 105.703 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.901–31.950 dari 264.555 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-16440 In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.	5.7 Medium	—	0,30%	19 Agt 2026
CVE-2026-76166 A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "S...	4.3 Medium	—	1,0%	19 Agt 2026
CVE-2026-76164 AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the...	7.1 High	—	0,41%	19 Agt 2026
CVE-2026-75900 An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a po...	6.1 Medium	—	0,11%	19 Agt 2026
CVE-2026-75589 Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares...	7.5 High	—	0,51%	19 Agt 2026
CVE-2026-72889 Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signature_meth...	9.8 Critical	—	0,45%	19 Agt 2026
CVE-2026-58088 freebsd The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time t...	7.4 High	—	0,11%	19 Agt 2026
CVE-2026-58087 freebsd The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that co...	7.8 High	—	0,17%	19 Agt 2026
CVE-2026-58086 freebsd As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore no...	8.1 High	—	0,38%	19 Agt 2026
CVE-2026-58085 freebsd After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus sile...	7.5 High	—	0,32%	19 Agt 2026
CVE-2026-58084 freebsd To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a timer using CLOCK_TAI this can fa...	5.5 Medium	—	0,14%	19 Agt 2026
CVE-2026-58083 freebsd While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. T...	8.4 High	—	0,17%	19 Agt 2026
CVE-2026-58082 freebsd The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per c...	9.8 Critical	—	0,52%	19 Agt 2026
CVE-2026-58081 freebsd Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An...	9.8 Critical	—	0,52%	19 Agt 2026
CVE-2026-49425 freebsd The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may o...	5.5 Medium	—	0,15%	19 Agt 2026
CVE-2026-49424 freebsd The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged u...	5.5 Medium	—	0,15%	19 Agt 2026
CVE-2026-75981 The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to...	7.2 High	—	0,39%	19 Agt 2026
CVE-2026-49423 freebsd When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that...	3.3 Low	—	0,14%	19 Agt 2026
CVE-2026-15780 The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' paramet...	7.2 High	—	0,65%	19 Agt 2026
CVE-2026-15446 The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, an...	6.4 Medium	—	0,42%	19 Agt 2026
CVE-2026-8810 On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables.	6.9 Medium	—	0,14%	19 Agt 2026
CVE-2026-49431 freebsd The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that...	3.3 Low	—	0,12%	19 Agt 2026
CVE-2026-49430 freebsd The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as...	7.8 High	—	0,15%	19 Agt 2026
CVE-2026-49429 freebsd The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-...	7.8 High	—	0,15%	19 Agt 2026
CVE-2026-49428 freebsd Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on...	8.4 High	—	0,34%	19 Agt 2026
CVE-2026-49427 freebsd Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlyi...	8.8 High	—	0,50%	19 Agt 2026
CVE-2026-49426 freebsd When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the ac...	3.3 Low	—	0,14%	19 Agt 2026
CVE-2026-49422 freebsd The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the T...	8.4 High	—	0,17%	19 Agt 2026
CVE-2026-49421 freebsd The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The f...	7.1 High	—	0,13%	19 Agt 2026
CVE-2026-49420 freebsd The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the resul...	8.8 High	—	0,42%	19 Agt 2026
CVE-2026-19842 The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administr...	8.8 High	—	0,26%	19 Agt 2026
CVE-2026-19782 The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to re...	5.4 Medium	—	0,25%	19 Agt 2026
CVE-2026-19709 The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one su...	5.3 Medium	—	0,32%	19 Agt 2026
CVE-2026-19417 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level user...	6.5 Medium	—	0,34%	19 Agt 2026
CVE-2026-19416 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to ca...	4.3 Medium	—	0,27%	19 Agt 2026
CVE-2026-19406 The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allow...	2.7 Low	—	0,32%	19 Agt 2026
CVE-2026-19056 The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative...	7.1 High	—	0,25%	19 Agt 2026
CVE-2026-19055 The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages,...	7.1 High	—	0,25%	19 Agt 2026
CVE-2026-18937 The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthent...	9.0 Critical	—	2,0%	19 Agt 2026
CVE-2026-18779 The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary app...	5.3 Medium	—	0,30%	19 Agt 2026
CVE-2026-18778 The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the person...	5.3 Medium	—	0,35%	19 Agt 2026
CVE-2026-18777 The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of...	5.3 Medium	—	0,30%	19 Agt 2026
CVE-2026-18776 The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email ad...	9.8 Critical	—	0,50%	19 Agt 2026
CVE-2026-18466 The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account...	5.4 Medium	—	0,29%	19 Agt 2026
CVE-2026-18231 The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowi...	5.3 Medium	—	0,35%	19 Agt 2026
CVE-2026-18202 The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload f...	6.8 Medium	—	0,43%	19 Agt 2026
CVE-2026-18051 The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to wri...	10.0 Critical	—	2,0%	19 Agt 2026
CVE-2026-18031 The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced ord...	9.8 Critical	—	0,50%	19 Agt 2026
CVE-2026-17565 The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request,...	7.2 High	—	0,28%	19 Agt 2026
CVE-2026-16979 The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at leas...	4.3 Medium	—	0,27%	19 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.