Katalog CVE (hal. 670)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.825 (Critical 36.490 · High 105.809 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 33.451–33.500 dari 264.825 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73348 Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.	6.5 Medium	—	0,27%	18 Agt 2026
CVE-2026-73345 Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.	7.1 High	—	0,29%	18 Agt 2026
CVE-2026-73343 Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.	10.0 Critical	—	0,86%	18 Agt 2026
CVE-2026-73342 Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-73341 Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.	9.8 Critical	—	0,56%	18 Agt 2026
CVE-2026-73339 Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.	9.3 Critical	—	0,40%	18 Agt 2026
CVE-2026-73338 Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-73190 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Bas...	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-73187 Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.	9.3 Critical	—	0,40%	18 Agt 2026
CVE-2026-73181 Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.	7.5 High	—	0,50%	18 Agt 2026
CVE-2026-71539 n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a va...	8.9 High	—	0,31%	18 Agt 2026
CVE-2026-70657 Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a val...	4.3 Medium	—	0,33%	18 Agt 2026
CVE-2026-69189 Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, env...	7.6 High	—	0,39%	18 Agt 2026
CVE-2026-68939 Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version...	2.0 Low	—	0,17%	18 Agt 2026
CVE-2026-68568 Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.	6.3 Medium	—	0,26%	18 Agt 2026
CVE-2026-68567 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based...	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-68565 Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66793 A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namesp...	8.8 High	—	0,81%	18 Agt 2026
CVE-2026-66679 Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.	6.5 Medium	—	0,35%	18 Agt 2026
CVE-2026-66667 Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-66651 Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This...	6.5 Medium	—	0,27%	18 Agt 2026
CVE-2026-66646 Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66645 Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66644 Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66643 Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66641 Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66640 Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66639 Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66638 Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66637 Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66636 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise...	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66635 Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through...	7.4 High	—	0,17%	18 Agt 2026
CVE-2026-66634 Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.	4.3 Medium	—	0,27%	18 Agt 2026
CVE-2026-66633 Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-66629 Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-66627 Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a thr...	9.9 Critical	—	0,48%	18 Agt 2026
CVE-2026-66622 Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.	7.5 High	—	0,32%	18 Agt 2026
CVE-2026-66621 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro all...	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-66620 Editor PHP Object Injection in OptionTree <= 2.7.3 versions.	7.2 High	—	0,54%	18 Agt 2026
CVE-2026-66046 libexpat project libexpat Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N sp...	7.5 High	—	0,74%	18 Agt 2026
CVE-2026-63639 Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns...	8.8 High	—	1,2%	18 Agt 2026
CVE-2026-63632 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perfo...	3.3 Low	—	0,17%	18 Agt 2026
CVE-2026-61407 Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access...	8.8 High	—	0,15%	18 Agt 2026
CVE-2026-59949 yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments...	6.5 Medium	—	0,47%	18 Agt 2026
CVE-2026-59940 Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controll...	9.8 Critical	—	0,81%	18 Agt 2026
CVE-2026-59825 Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenti...	7.4 High	—	0,37%	18 Agt 2026
CVE-2026-56684 Advisory Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authe...	7.5 High	—	0,89%	18 Agt 2026
CVE-2026-50187 Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FIL...	8.8 High	—	0,54%	18 Agt 2026
CVE-2026-50139 goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the fil...	5.9 Medium	—	0,26%	18 Agt 2026
CVE-2026-50138 goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--uploa...	8.1 High	—	0,38%	18 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.