Katalog CVE (hal. 640)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.555 (Critical 36.456 · High 105.703 · KEV 1.760 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 31.951–32.000 dari 264.555 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-16950 The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attack...	8.6 High	—	0,45%	19 Agt 2026
CVE-2026-16617 The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing una...	8.8 High	—	0,51%	19 Agt 2026
CVE-2026-16616 The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read...	8.6 High	—	0,73%	19 Agt 2026
CVE-2026-16570 The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages,...	7.1 High	—	0,25%	19 Agt 2026
CVE-2026-16058 The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable b...	5.3 Medium	—	0,32%	19 Agt 2026
CVE-2026-15253 The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list...	6.8 Medium	—	0,43%	19 Agt 2026
CVE-2026-14861 The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied us...	7.5 High	—	0,44%	19 Agt 2026
CVE-2026-14826 The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification...	2.7 Low	—	0,30%	19 Agt 2026
CVE-2026-14825 The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing us...	2.7 Low	—	0,28%	19 Agt 2026
CVE-2026-14334 The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to uplo...	8.8 High	—	0,54%	19 Agt 2026
CVE-2026-14287 The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied...	4.7 Medium	—	0,22%	19 Agt 2026
CVE-2026-14196 The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any v...	4.3 Medium	—	0,25%	19 Agt 2026
CVE-2026-13175 The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level ac...	6.5 Medium	—	0,42%	19 Agt 2026
CVE-2026-13174 The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above...	7.2 High	—	0,46%	19 Agt 2026
CVE-2026-13173 The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during spe...	2.7 Low	—	0,28%	19 Agt 2026
CVE-2026-13169 The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author...	8.1 High	—	0,35%	19 Agt 2026
CVE-2026-12983 The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection...	8.6 High	—	0,45%	19 Agt 2026
CVE-2026-11565 The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role...	8.5 High	—	1,3%	19 Agt 2026
CVE-2026-70408 An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.	8.7 High	—	0,45%	19 Agt 2026
CVE-2026-66358 A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.	5.1 Medium	—	0,26%	19 Agt 2026
CVE-2026-49419 freebsd When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor....	8.8 High	—	0,47%	19 Agt 2026
CVE-2026-49418 freebsd When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page...	8.8 High	—	0,47%	19 Agt 2026
CVE-2026-49415 freebsd During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the sa...	8.8 High	—	0,36%	19 Agt 2026
CVE-2026-19942 The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to ins...	8.1 High	—	1,1%	19 Agt 2026
CVE-2026-76050 A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete_menu. The m...	7.3 High	—	0,43%	19 Agt 2026
CVE-2026-76049 A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=save_menu. Th...	7.3 High	—	0,43%	19 Agt 2026
CVE-2026-76048 A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Exec...	7.3 High	—	0,43%	19 Agt 2026
CVE-2026-76014 A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handle...	3.3 Low	—	0,16%	19 Agt 2026
CVE-2026-76008 A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. Thi...	10.0 Critical	—	1,0%	19 Agt 2026
CVE-2026-76004 A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApB...	9.9 Critical	—	0,79%	19 Agt 2026
CVE-2026-76003 A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of th...	9.9 Critical	—	0,79%	19 Agt 2026
CVE-2026-75987 A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/Socket...	7.3 High	—	0,56%	19 Agt 2026
CVE-2026-75986 A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Passwo...	7.3 High	—	0,43%	19 Agt 2026
CVE-2026-75985 A flaw has been found in TRENDnet Router 1.1.02b01. The affected element is an unknown function of the file /cgi-bin/ping.cgi. This manipulation of the argument wan_type...	7.4 High	—	1,8%	19 Agt 2026
CVE-2026-15421 The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all version...	6.4 Medium	—	0,41%	19 Agt 2026
CVE-2026-11751 A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle...	9.1 Critical	—	0,32%	19 Agt 2026
CVE-2026-75984 A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulation of the argument Hostname r...	7.4 High	—	1,8%	19 Agt 2026
CVE-2026-75979 A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the...	6.3 Medium	—	0,41%	19 Agt 2026
CVE-2026-75978 A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file Data...	6.3 Medium	—	0,37%	19 Agt 2026
CVE-2026-75976 A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of...	9.9 Critical	—	0,85%	19 Agt 2026
CVE-2025-11729 The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on...	4.3 Medium	—	0,28%	19 Agt 2026
CVE-2026-66591 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue...	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66589 Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/...	5.4 Medium	—	0,23%	18 Agt 2026
CVE-2026-27365 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affe...	5.9 Medium	—	0,24%	18 Agt 2026
CVE-2026-73974 linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing he...	5.5 Medium	—	0,17%	18 Agt 2026
CVE-2026-73973 Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-...	5.5 Medium	—	0,29%	18 Agt 2026
CVE-2026-66603 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This i...	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66602 Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPres...	8.8 High	—	0,20%	18 Agt 2026
CVE-2026-62377 libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the conte...	4.3 Medium	—	0,41%	18 Agt 2026
CVE-2026-62292 libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can...	8.7 High	—	0,56%	18 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.