Katalog CVE (hal. 722)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.400 (Critical 36.562 · High 106.027 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 30 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.051–36.100 dari 265.400 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-14298 mattermost server Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum f...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-3639 The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, an...	6.4 Medium	—	0,35%	13 Agt 2026
CVE-2026-11840 Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.	8.8 High	—	3,1%	13 Agt 2026
CVE-2026-18622 foxit pdf editor, foxit pdf reader Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication....	5.5 Medium	—	0,13%	13 Agt 2026
CVE-2026-18146 The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notificat...	7.2 High	—	0,49%	13 Agt 2026
CVE-2026-3835 The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in t...	5.3 Medium	—	0,47%	13 Agt 2026
CVE-2026-19088 The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker...	5.4 Medium	—	0,14%	13 Agt 2026
CVE-2026-18945 The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX acti...	8.2 High	—	0,33%	13 Agt 2026
CVE-2026-14213 The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment b...	3.7 Low	—	0,26%	13 Agt 2026
CVE-2026-14182 The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose compa...	9.8 Critical	—	0,50%	13 Agt 2026
CVE-2026-13610 The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers t...	7.5 High	—	0,41%	13 Agt 2026
CVE-2026-13328 The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthen...	5.3 Medium	—	0,30%	13 Agt 2026
CVE-2026-72506 VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination in a communication channel vulne...	5.1 Medium	—	0,31%	13 Agt 2026
CVE-2026-19182 An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_REST) to acknowledge, escalate,...	4.3 Medium	—	0,25%	13 Agt 2026
CVE-2026-19135 A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the M...	5.4 Medium	—	0,29%	13 Agt 2026
CVE-2026-18728 redhat enterprise linux A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsin...	6.5 Medium	—	0,31%	13 Agt 2026
CVE-2026-0301 paloaltonetworks cloud ngfw, paloaltonetworks prisma access +1 lainnya An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain...	7.5 High	—	0,56%	13 Agt 2026
CVE-2026-0299 paloaltonetworks globalprotect Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows...	7.8 High	—	0,17%	13 Agt 2026
CVE-2026-0298 paloaltonetworks globalprotect An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows device...	8.1 High	—	0,66%	13 Agt 2026
CVE-2026-0297 paloaltonetworks globalprotect A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system...	8.1 High	—	0,60%	13 Agt 2026
CVE-2026-0296 paloaltonetworks globalprotect Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to interc...	7.4 High	—	0,26%	13 Agt 2026
CVE-2026-0295 paloaltonetworks globalprotect A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. T...	7.0 High	—	0,11%	13 Agt 2026
CVE-2026-0294 paloaltonetworks prisma access agent A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevat...	7.8 High	—	0,17%	13 Agt 2026
CVE-2026-0293 paloaltonetworks prisma access agent A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enablin...	6.0 Medium	—	0,16%	13 Agt 2026
CVE-2026-0292 paloaltonetworks prisma access agent An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administrator to bypass security inspec...	6.0 Medium	—	0,19%	13 Agt 2026
CVE-2026-0291 paloaltonetworks prisma access agent An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged...	4.4 Medium	—	0,15%	13 Agt 2026
CVE-2026-0290 paloaltonetworks prisma browser An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data.	5.5 Medium	—	0,15%	13 Agt 2026
CVE-2026-0289 paloaltonetworks prisma browser A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls.	6.5 Medium	—	0,31%	13 Agt 2026
CVE-2026-50544 NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at `sr...	6.3 Medium	—	0,13%	13 Agt 2026
CVE-2026-49819 UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backe...	9.8 Critical	—	1,1%	13 Agt 2026
CVE-2026-49473 @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests t...	8.8 High	—	0,47%	13 Agt 2026
CVE-2026-48791 sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time)...	2.0 Low	—	0,07%	13 Agt 2026
CVE-2026-46688 The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect t...	6.9 Medium	—	0,42%	13 Agt 2026
CVE-2026-46382 The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be...	8.7 High	—	0,42%	13 Agt 2026
CVE-2026-17431 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for. to_pdf re...	6.1 Medium	—	0,95%	13 Agt 2026
CVE-2026-16770 PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file source, the construc...	9.8 Critical	—	0,73%	13 Agt 2026
CVE-2026-71194 In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name ex...	6.8 Medium	—	0,52%	12 Agt 2026
CVE-2026-71193 In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authe...	9.6 Critical	—	0,53%	12 Agt 2026
CVE-2026-49481 UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of...	9.6 Critical	—	1,5%	12 Agt 2026
CVE-2026-47718 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to re...	5.5 Medium	—	0,46%	12 Agt 2026
CVE-2026-47717 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configurat...	7.5 High	—	1,4%	12 Agt 2026
CVE-2026-15141 tp-link tl-wr820n firmware The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Refer...	5.7 Medium	—	0,18%	12 Agt 2026
CVE-2026-7366 ibm datapower gateway IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race con...	4.2 Medium	—	0,16%	12 Agt 2026
CVE-2026-73519 WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unau...	9.8 Critical	—	1,2%	12 Agt 2026
CVE-2026-73501 kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil Authent...	9.1 Critical	—	0,43%	12 Agt 2026
CVE-2026-73500 etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS list...	8.7 High	—	0,40%	12 Agt 2026
CVE-2026-73499 etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact...	7.1 High	—	0,66%	12 Agt 2026
CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its client-suppl...	7.7 High	—	0,48%	12 Agt 2026
CVE-2026-73495 blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body tra...	7.4 High	—	0,48%	12 Agt 2026
CVE-2026-73493 Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an inc...	7.5 High	—	0,63%	12 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.