Katalog CVE (hal. 709)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.369 (Critical 36.560 · High 106.018 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 35.401–35.450 dari 265.369 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-72815 go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forw...	6.9 Medium	—	0,50%	14 Agt 2026
CVE-2026-72814 The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument...	6.3 Medium	—	0,47%	14 Agt 2026
CVE-2026-72813 actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remo...	6.9 Medium	—	0,49%	14 Agt 2026
CVE-2026-72812 SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent s...	6.5 Medium	—	0,38%	14 Agt 2026
CVE-2026-72811 SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata...	10.0 Critical	—	0,44%	14 Agt 2026
CVE-2026-72810 SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. A...	8.6 High	—	0,54%	14 Agt 2026
CVE-2026-19822 A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit...	8.8 High	—	0,85%	14 Agt 2026
CVE-2025-71405 chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attacke...	5.1 Medium	—	0,39%	14 Agt 2026
CVE-2026-19821 A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19815 A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the co...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19814 A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. P...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19813 A security vulnerability has been detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the c...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19812 A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component pr...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19794 The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and outpu...	7.2 High	—	0,32%	14 Agt 2026
CVE-2026-19811 A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the c...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19617 redhat hardened images, redhat openshift container platform +1 lainnya A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to...	5.5 Medium	—	0,16%	14 Agt 2026
CVE-2026-18039 The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowin...	8.1 High	—	0,38%	14 Agt 2026
CVE-2026-16810 The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'data[q...	6.5 Medium	—	0,45%	14 Agt 2026
CVE-2026-16739 The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, n...	5.9 Medium	—	0,29%	14 Agt 2026
CVE-2026-15205 The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthe...	8.6 High	—	0,45%	14 Agt 2026
CVE-2026-14290 The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users wit...	6.8 Medium	—	0,43%	14 Agt 2026
CVE-2026-12949 The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This...	9.8 Critical	—	0,53%	14 Agt 2026
CVE-2026-12743 The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all...	4.9 Medium	—	0,44%	14 Agt 2026
CVE-2026-19792 A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management i...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19791 A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web manag...	8.8 High	—	0,85%	14 Agt 2026
CVE-2025-10308 The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce valida...	4.3 Medium	—	0,18%	14 Agt 2026
CVE-2026-19790 A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Managem...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19789 A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19788 A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd we...	8.8 High	—	0,85%	14 Agt 2026
CVE-2026-19787 A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_type. Execu...	4.7 Medium	—	0,35%	14 Agt 2026
CVE-2026-19786 A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results...	4.3 Medium	—	0,24%	14 Agt 2026
CVE-2026-19785 A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php o...	6.3 Medium	—	0,34%	14 Agt 2026
CVE-2026-19784 A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authoriz...	4.3 Medium	—	0,46%	14 Agt 2026
CVE-2026-18109 The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insuffici...	7.2 High	—	0,43%	14 Agt 2026
CVE-2026-19771 A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. S...	7.2 High	—	3,7%	14 Agt 2026
CVE-2026-19770 A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.t...	5.3 Medium	—	0,15%	14 Agt 2026
CVE-2026-19767 A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a m...	6.3 Medium	—	0,33%	14 Agt 2026
CVE-2026-19765 A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSource of the f...	6.3 Medium	—	0,37%	14 Agt 2026
CVE-2026-19764 A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd....	7.3 High	—	0,41%	14 Agt 2026
CVE-2026-19763 A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the componen...	3.8 Low	—	0,56%	14 Agt 2026
CVE-2026-19762 A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file FileChunkController.java of the component Chunk-Chec...	7.3 High	—	0,62%	14 Agt 2026
CVE-2026-19761 A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Uploa...	4.7 Medium	—	0,51%	14 Agt 2026
CVE-2026-19758 A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-...	7.3 High	—	0,62%	14 Agt 2026
CVE-2026-19757 A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload C...	7.3 High	—	0,62%	14 Agt 2026
CVE-2026-19756 A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator....	6.3 Medium	—	0,43%	13 Agt 2026
CVE-2026-19753 A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the comp...	7.3 High	—	0,47%	13 Agt 2026
CVE-2026-73843 OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs...	9.6 Critical	—	0,48%	13 Agt 2026
CVE-2026-73842 OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /a...	9.0 Critical	—	0,27%	13 Agt 2026
CVE-2026-73841 OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-ap...	8.8 High	—	0,81%	13 Agt 2026
CVE-2026-73840 OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/open...	5.3 Medium	—	0,35%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.