Katalog CVE (hal. 727)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 265.720 (Critical 36.587 · High 106.162 · KEV 1.764 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 36.301–36.350 dari 265.720 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-73607 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attack...	5.8 Medium	—	0,25%	13 Agt 2026
CVE-2026-73606 SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers....	5.8 Medium	—	0,33%	13 Agt 2026
CVE-2026-73605 SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without...	5.8 Medium	—	0,33%	13 Agt 2026
CVE-2026-73604 flowiseai flowise Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Au...	6.5 Medium	—	0,41%	13 Agt 2026
CVE-2026-73603 flowiseai flowise Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. U...	5.3 Medium	—	0,33%	13 Agt 2026
CVE-2026-73602 flowiseai flowise Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment...	9.9 Critical	—	0,83%	13 Agt 2026
CVE-2026-73601 flowiseai flowise Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users...	8.8 High	—	1,1%	13 Agt 2026
CVE-2026-73488 flowiseai flowise Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authe...	6.5 Medium	—	0,37%	13 Agt 2026
CVE-2026-73487 flowiseai flowise Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code vi...	9.8 Critical	—	0,96%	13 Agt 2026
CVE-2026-73486 flowiseai flowise Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Pyth...	8.8 High	—	0,66%	13 Agt 2026
CVE-2026-73485 flowiseai flowise Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassin...	8.8 High	—	0,60%	13 Agt 2026
CVE-2026-73484 flowiseai flowise Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and...	8.1 High	—	0,44%	13 Agt 2026
CVE-2026-73483 flowiseai flowise Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user wit...	8.8 High	—	0,62%	13 Agt 2026
CVE-2026-45819 baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process terminat...	6.6 Medium	—	0,51%	13 Agt 2026
CVE-2026-18368 In Teltonika Networks RUTOS devices, a vulnerability exists in modbusgwd due to improper handling of Modbus TCP request data. A remote, unauthenticated attacker with ac...	6.0 Medium	—	0,25%	13 Agt 2026
CVE-2026-16455 In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower pr...	6.9 Medium	—	0,29%	13 Agt 2026
CVE-2026-12263 Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper...	8.8 High	—	1,4%	13 Agt 2026
CVE-2026-59507 : Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to...	9.3 Critical	—	0,34%	13 Agt 2026
CVE-2026-59506 : Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal...	9.3 Critical	—	0,41%	13 Agt 2026
CVE-2026-59505 : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Pr...	8.6 High	—	0,39%	13 Agt 2026
CVE-2026-59504 : Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Port...	9.1 Critical	—	0,43%	13 Agt 2026
CVE-2026-59503 : Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Priority Portal Generato...	9.1 Critical	—	0,43%	13 Agt 2026
CVE-2026-59502 : Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Pri...	5.3 Medium	—	0,33%	13 Agt 2026
CVE-2026-59501 : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Pr...	8.2 High	—	0,34%	13 Agt 2026
CVE-2026-59500 : Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Pr...	10.0 Critical	—	0,50%	13 Agt 2026
CVE-2026-59499 : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).. This issue...	8.6 High	—	0,42%	13 Agt 2026
CVE-2026-19484 fastify/busyboy @fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipar...	7.5 High	—	0,62%	13 Agt 2026
CVE-2026-11970 This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758.	4.8 Medium	—	0,16%	13 Agt 2026
CVE-2026-19696 wireshark Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows	5.5 Medium	—	0,12%	13 Agt 2026
CVE-2026-19695 wireshark Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service	5.5 Medium	—	0,12%	13 Agt 2026
CVE-2026-19694 wireshark TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service	5.5 Medium	—	0,13%	13 Agt 2026
CVE-2026-19481 fastify/busyboy @fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part he...	7.5 High	—	0,49%	13 Agt 2026
CVE-2026-16459 Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plai...	5.9 Medium	—	0,09%	13 Agt 2026
CVE-2026-16458 Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via...	5.9 Medium	—	0,09%	13 Agt 2026
CVE-2026-15413 The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1...	10.0 Critical	—	0,52%	13 Agt 2026
CVE-2026-14332 The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management act...	5.4 Medium	—	0,29%	13 Agt 2026
CVE-2026-14298 mattermost server Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum f...	6.5 Medium	—	0,42%	13 Agt 2026
CVE-2026-3639 The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, an...	6.4 Medium	—	0,35%	13 Agt 2026
CVE-2026-11840 Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.	8.8 High	—	3,1%	13 Agt 2026
CVE-2026-18622 foxit pdf editor, foxit pdf reader Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication....	5.5 Medium	—	0,13%	13 Agt 2026
CVE-2026-18146 The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notificat...	7.2 High	—	0,49%	13 Agt 2026
CVE-2026-3835 The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in t...	5.3 Medium	—	0,47%	13 Agt 2026
CVE-2026-19088 The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker...	5.4 Medium	—	0,14%	13 Agt 2026
CVE-2026-18945 The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX acti...	8.2 High	—	0,33%	13 Agt 2026
CVE-2026-14213 The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment b...	3.7 Low	—	0,26%	13 Agt 2026
CVE-2026-14182 The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose compa...	9.8 Critical	—	0,50%	13 Agt 2026
CVE-2026-13610 The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers t...	7.5 High	—	0,41%	13 Agt 2026
CVE-2026-13328 The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthen...	5.3 Medium	—	0,30%	13 Agt 2026
CVE-2026-72506 VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination in a communication channel vulne...	5.1 Medium	—	0,31%	13 Agt 2026
CVE-2026-19182 An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_REST) to acknowledge, escalate,...	4.3 Medium	—	0,25%	13 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.