Katalog CVE (hal. 671)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 264.859 (Critical 36.491 · High 105.819 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 29 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 33.501–33.550 dari 264.859 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-68565 Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66793 A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namesp...	8.8 High	—	0,81%	18 Agt 2026
CVE-2026-66679 Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.	6.5 Medium	—	0,35%	18 Agt 2026
CVE-2026-66667 Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-66651 Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This...	6.5 Medium	—	0,27%	18 Agt 2026
CVE-2026-66646 Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66645 Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66644 Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66643 Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66641 Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66640 Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66639 Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66638 Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66637 Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66636 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise...	6.5 Medium	—	0,22%	18 Agt 2026
CVE-2026-66635 Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through...	7.4 High	—	0,17%	18 Agt 2026
CVE-2026-66634 Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.	4.3 Medium	—	0,27%	18 Agt 2026
CVE-2026-66633 Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-66629 Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-66627 Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a thr...	9.9 Critical	—	0,48%	18 Agt 2026
CVE-2026-66622 Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.	7.5 High	—	0,32%	18 Agt 2026
CVE-2026-66621 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro all...	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-66620 Editor PHP Object Injection in OptionTree <= 2.7.3 versions.	7.2 High	—	0,54%	18 Agt 2026
CVE-2026-66046 libexpat project libexpat Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N sp...	7.5 High	—	0,74%	18 Agt 2026
CVE-2026-63639 Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns...	8.8 High	—	1,2%	18 Agt 2026
CVE-2026-63632 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perfo...	3.3 Low	—	0,17%	18 Agt 2026
CVE-2026-61407 Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access...	8.8 High	—	0,15%	18 Agt 2026
CVE-2026-59949 yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments...	6.5 Medium	—	0,47%	18 Agt 2026
CVE-2026-59940 Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controll...	9.8 Critical	—	0,81%	18 Agt 2026
CVE-2026-59825 Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenti...	7.4 High	—	0,37%	18 Agt 2026
CVE-2026-56684 Advisory Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authe...	7.5 High	—	0,89%	18 Agt 2026
CVE-2026-50187 Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FIL...	8.8 High	—	0,54%	18 Agt 2026
CVE-2026-50139 goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the fil...	5.9 Medium	—	0,26%	18 Agt 2026
CVE-2026-50138 goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--uploa...	8.1 High	—	0,38%	18 Agt 2026
CVE-2026-48798 SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory...	7.1 High	—	0,42%	18 Agt 2026
CVE-2026-45733 Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value i...	8.3 High	—	0,43%	18 Agt 2026
CVE-2026-32553 Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.	7.2 High	—	0,27%	18 Agt 2026
CVE-2026-32549 Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.	7.5 High	—	0,39%	18 Agt 2026
CVE-2026-32547 Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.	7.1 High	—	0,25%	18 Agt 2026
CVE-2026-32481 Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.	7.5 High	—	0,49%	18 Agt 2026
CVE-2026-32474 Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.	9.9 Critical	—	0,48%	18 Agt 2026
CVE-2026-32473 Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.	7.2 High	—	0,27%	18 Agt 2026
CVE-2026-32472 Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.	7.5 High	—	0,39%	18 Agt 2026
CVE-2026-32470 Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.	9.8 Critical	—	0,56%	18 Agt 2026
CVE-2026-18534 ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interf...	7.4 High	—	0,34%	18 Agt 2026
CVE-2026-50575 BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client...	7.7 High	—	0,22%	18 Agt 2026
CVE-2026-32468 Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.	7.5 High	—	0,42%	18 Agt 2026
CVE-2026-32467 Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.	6.0 Medium	—	0,21%	18 Agt 2026
CVE-2026-32466 Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.	8.5 High	—	0,36%	18 Agt 2026
CVE-2026-32465 Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.	8.8 High	—	0,52%	18 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.