Katalog CVE (hal. 690)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.211 (Critical 36.541 · High 105.926 · KEV 1.762 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 34.451–34.500 dari 265.211 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-16775 The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in a...	6.4 Medium	—	0,33%	16 Agt 2026
CVE-2026-16758 The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insuf...	6.4 Medium	—	0,33%	16 Agt 2026
CVE-2026-15790 The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is du...	6.4 Medium	—	0,32%	16 Agt 2026
CVE-2026-15604 The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post meta field....	6.4 Medium	—	0,33%	16 Agt 2026
CVE-2026-15384 The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment imag...	5.7 Medium	—	0,15%	16 Agt 2026
CVE-2026-15351 The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter...	4.9 Medium	—	0,48%	16 Agt 2026
CVE-2026-15345 The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11...	4.3 Medium	—	0,43%	16 Agt 2026
CVE-2026-15056 The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up...	6.5 Medium	—	1,1%	16 Agt 2026
CVE-2026-13712 The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users w...	5.4 Medium	—	0,23%	16 Agt 2026
CVE-2026-10035 The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted...	6.6 Medium	—	0,69%	16 Agt 2026
CVE-2026-19933 A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module....	6.3 Medium	—	0,43%	16 Agt 2026
CVE-2026-19932 A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the compone...	6.3 Medium	—	0,41%	16 Agt 2026
CVE-2026-18432 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because...	9.8 Critical	—	0,84%	16 Agt 2026
CVE-2026-18385 The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitr...	5.4 Medium	—	0,52%	16 Agt 2026
CVE-2026-17123 The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'web...	8.8 High	—	0,63%	16 Agt 2026
CVE-2026-16779 The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly v...	4.3 Medium	—	0,39%	16 Agt 2026
CVE-2026-16099 The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in a...	8.8 High	—	1,1%	16 Agt 2026
CVE-2026-16098 The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload functio...	9.8 Critical	—	1,2%	16 Agt 2026
CVE-2026-16079 The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due...	6.5 Medium	—	0,47%	16 Agt 2026
CVE-2026-15963 The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in all version...	6.5 Medium	—	0,45%	16 Agt 2026
CVE-2026-15726 The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to in...	6.4 Medium	—	0,35%	16 Agt 2026
CVE-2026-15602 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up t...	4.9 Medium	—	0,44%	16 Agt 2026
CVE-2026-15441 The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll_offset' shortcode attribute e...	5.3 Medium	—	0,53%	16 Agt 2026
CVE-2026-15066 The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to ins...	6.4 Medium	—	0,36%	16 Agt 2026
CVE-2026-15009 The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's...	6.1 Medium	—	0,39%	16 Agt 2026
CVE-2026-15002 The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm_woocommerc...	7.2 High	—	0,42%	16 Agt 2026
CVE-2026-14524 The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProcess function...	9.1 Critical	—	1,1%	16 Agt 2026
CVE-2026-14498 The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is...	8.8 High	—	1,0%	16 Agt 2026
CVE-2026-13358 The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t...	6.5 Medium	—	0,68%	16 Agt 2026
CVE-2026-13167 The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up t...	4.3 Medium	—	0,47%	16 Agt 2026
CVE-2026-12905 The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff...	4.3 Medium	—	0,39%	16 Agt 2026
CVE-2026-12477 The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and i...	4.4 Medium	—	0,33%	16 Agt 2026
CVE-2026-11780 The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all...	6.4 Medium	—	0,42%	16 Agt 2026
CVE-2025-10005 The PPWP – Password Protect WordPress \| #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and...	4.3 Medium	—	0,33%	16 Agt 2026
CVE-2026-2487 The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficien...	4.4 Medium	—	0,33%	16 Agt 2026
CVE-2026-19930 A security flaw has been discovered in Dolibarr up to 23.0.3. Affected is an unknown function of the file htdocs/user/card.php of the component User Cloning. The manipula...	6.3 Medium	—	0,42%	16 Agt 2026
CVE-2026-19929 A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails-app/controllers/org/pih/warehouse/core/DocumentCo...	6.3 Medium	—	0,50%	16 Agt 2026
CVE-2026-19928 A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy...	6.3 Medium	—	0,44%	16 Agt 2026
CVE-2026-19927 A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductContro...	6.3 Medium	—	0,44%	16 Agt 2026
CVE-2026-19926 A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the compo...	7.3 High	—	0,44%	16 Agt 2026
CVE-2026-19925 A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=delete_supplier....	4.7 Medium	—	0,35%	16 Agt 2026
CVE-2026-19924 A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. Th...	9.8 Critical	—	1,4%	16 Agt 2026
CVE-2026-19923 A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkout_process.php. Executing a manipulation of th...	6.3 Medium	—	0,33%	16 Agt 2026
CVE-2026-19922 A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performin...	3.5 Low	—	0,35%	16 Agt 2026
CVE-2026-19921 A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /homeaction.php. Such m...	6.3 Medium	—	0,33%	16 Agt 2026
CVE-2026-19920 A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the argument pro...	6.3 Medium	—	0,33%	16 Agt 2026
CVE-2026-19919 A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of...	7.3 High	—	0,43%	16 Agt 2026
CVE-2026-19918 A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Interface. The...	6.3 Medium	—	0,35%	16 Agt 2026
CVE-2026-19917 A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_items1.php. Executing a manipulat...	6.3 Medium	—	0,33%	15 Agt 2026
CVE-2026-74767 Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compre...	8.7 High	—	0,43%	15 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.