Katalog CVE (hal. 705)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.369 (Critical 36.560 · High 106.018 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.201–35.250 dari 265.369 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-68477 In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 tran...	9.8 Critical	—	0,71%	15 Agt 2026
CVE-2026-68476 In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() calls skb_ensure_writable() whic...	9.8 Critical	—	0,71%	15 Agt 2026
CVE-2026-68474 In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() spufs_mem_mmap_access() computes...	7.8 High	—	0,16%	15 Agt 2026
CVE-2026-68473 In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address() mask_user_address() incorr...	7.8 High	—	0,17%	15 Agt 2026
CVE-2026-68472 In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211_gen_new_ie() copies ML probe response e...	8.1 High	—	0,34%	15 Agt 2026
CVE-2026-68471 In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211_mle_common_size() uses the first common-i...	8.8 High	—	0,34%	15 Agt 2026
CVE-2026-68470 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension h...	8.8 High	—	0,36%	15 Agt 2026
CVE-2026-68467 In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in bot...	7.8 High	—	0,13%	15 Agt 2026
CVE-2026-68466 In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout lpc32xx_xmit_dma() waits for the...	8.8 High	—	0,13%	15 Agt 2026
CVE-2026-68462 In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR...	7.8 High	—	0,17%	15 Agt 2026
CVE-2026-68461 In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnode_handle in fwnode_init() If a firmware nod...	7.8 High	—	0,18%	15 Agt 2026
CVE-2026-68458 In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it binder_transaction() bounds the scatter-gather bu...	7.8 High	—	0,13%	15 Agt 2026
CVE-2026-68457 In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION oper...	9.1 Critical	—	0,70%	15 Agt 2026
CVE-2026-18807 The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who ca...	4.3 Medium	—	0,25%	15 Agt 2026
CVE-2026-18216 The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a mult...	6.5 Medium	—	0,51%	15 Agt 2026
CVE-2026-16611 The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthen...	7.5 High	—	0,43%	15 Agt 2026
CVE-2026-16541 The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is ent...	6.5 Medium	—	0,37%	15 Agt 2026
CVE-2026-16007 AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in t...	7.1 High	—	0,34%	15 Agt 2026
CVE-2026-14230 The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic n...	5.4 Medium	—	0,23%	15 Agt 2026
CVE-2026-14229 The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, al...	5.3 Medium	—	0,32%	15 Agt 2026
CVE-2026-18387 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all versions up t...	6.5 Medium	—	0,66%	15 Agt 2026
CVE-2026-17090 The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (Button Code)...	6.4 Medium	—	0,41%	15 Agt 2026
CVE-2026-16586 The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Ord...	6.5 Medium	—	0,55%	15 Agt 2026
CVE-2026-16146 The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all ve...	4.9 Medium	—	0,50%	15 Agt 2026
CVE-2026-16145 The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in al...	7.2 High	—	0,46%	15 Agt 2026
CVE-2026-16094 The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all version...	4.9 Medium	—	0,58%	15 Agt 2026
CVE-2026-15993 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynam...	5.3 Medium	—	0,49%	15 Agt 2026
CVE-2026-15948 The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all vers...	6.4 Medium	—	0,36%	15 Agt 2026
CVE-2026-15453 The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to,...	6.5 Medium	—	0,41%	15 Agt 2026
CVE-2026-13360 The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions...	7.2 High	—	0,43%	15 Agt 2026
CVE-2026-8840 The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to t...	5.3 Medium	—	0,55%	15 Agt 2026
CVE-2026-16080 The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post_title' parameter in all versions up to, and including, 1.4.6 due...	6.5 Medium	—	0,41%	15 Agt 2026
CVE-2026-15965 The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4...	8.8 High	—	1,0%	15 Agt 2026
CVE-2026-15341 The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `sy...	9.8 Critical	—	0,59%	15 Agt 2026
CVE-2026-15312 The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to...	8.8 High	—	0,52%	15 Agt 2026
CVE-2026-15303 The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user()...	9.8 Critical	—	0,84%	15 Agt 2026
CVE-2026-15162 The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-salesforce/pu...	7.5 High	—	0,58%	15 Agt 2026
CVE-2026-15001 The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the...	8.8 High	—	0,69%	15 Agt 2026
CVE-2026-14484 The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the h...	9.1 Critical	—	1,2%	15 Agt 2026
CVE-2026-14433 The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in all v...	7.2 High	—	0,42%	15 Agt 2026
CVE-2026-12128 The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and including, 2.9.9...	5.3 Medium	—	0,61%	15 Agt 2026
CVE-2026-74250 In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy inter...	6.3 Medium	—	0,30%	14 Agt 2026
CVE-2026-74247 redhat openshift update service, redhat quay A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability wit...	7.1 High	—	0,25%	14 Agt 2026
CVE-2026-74245 redhat openshift update service, redhat quay A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorizatio...	7.5 High	—	0,42%	14 Agt 2026
CVE-2026-74244 redhat openshift update service, redhat quay A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON r...	7.5 High	—	0,23%	14 Agt 2026
CVE-2026-74243 redhat openshift update service, redhat quay A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security s...	8.2 High	—	0,46%	14 Agt 2026
CVE-2026-74242 redhat openshift update service, redhat quay A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the no...	4.4 Medium	—	0,33%	14 Agt 2026
CVE-2026-74241 redhat openshift update service, redhat quay A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication,...	6.5 Medium	—	0,31%	14 Agt 2026
CVE-2026-74240 redhat openshift update service, redhat quay A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audien...	5.4 Medium	—	0,29%	14 Agt 2026
CVE-2026-63650 OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field	2.0 Low	—	0,23%	14 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.