Katalog CVE (hal. 772)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.139 (Critical 36.631 · High 106.324 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 31 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.551–38.600 dari 266.139 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-21059 samsung android Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privile...	7.1 High	—	0,13%	10 Agt 2026
CVE-2026-21058 samsung android Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.	7.1 High	—	0,14%	10 Agt 2026
CVE-2026-19089 The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own...	9.8 Critical	—	3,2%	10 Agt 2026
CVE-2026-19077 The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an...	6.5 Medium	—	0,42%	10 Agt 2026
CVE-2026-19075 All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Pu...	5.0 Medium	—	0,27%	10 Agt 2026
CVE-2026-19074 The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive informat...	5.3 Medium	—	0,17%	10 Agt 2026
CVE-2026-19053 The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors,...	9.1 Critical	—	0,42%	10 Agt 2026
CVE-2026-19049 The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request withou...	8.6 High	—	0,52%	10 Agt 2026
CVE-2026-18960 The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application pas...	5.4 Medium	—	0,28%	10 Agt 2026
CVE-2026-18946 The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible dire...	7.5 High	—	0,43%	10 Agt 2026
CVE-2026-18934 The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allow...	5.5 Medium	—	0,31%	10 Agt 2026
CVE-2026-18786 The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error...	8.8 High	—	0,54%	10 Agt 2026
CVE-2026-18666 The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with...	4.3 Medium	—	0,27%	10 Agt 2026
CVE-2026-18470 The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the...	7.5 High	—	0,43%	10 Agt 2026
CVE-2026-18469 The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification c...	8.1 High	—	0,38%	10 Agt 2026
CVE-2026-18468 The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed th...	8.1 High	—	0,38%	10 Agt 2026
CVE-2026-18200 The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users,...	4.3 Medium	—	0,25%	10 Agt 2026
CVE-2026-18030 The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions,...	8.1 High	—	0,38%	10 Agt 2026
CVE-2026-17542 The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such...	7.5 High	—	0,42%	10 Agt 2026
CVE-2026-17541 The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity...	7.5 High	—	0,43%	10 Agt 2026
CVE-2026-17540 The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read an...	8.8 High	—	1,8%	10 Agt 2026
CVE-2026-17023 The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization ca...	4.8 Medium	—	0,27%	10 Agt 2026
CVE-2026-17022 The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation ste...	7.5 High	—	0,43%	10 Agt 2026
CVE-2026-17021 The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership...	5.3 Medium	—	0,30%	10 Agt 2026
CVE-2026-17020 The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only...	4.3 Medium	—	0,27%	10 Agt 2026
CVE-2026-17019 The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them,...	6.1 Medium	—	0,28%	10 Agt 2026
CVE-2026-17018 The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of...	4.9 Medium	—	0,38%	10 Agt 2026
CVE-2026-17016 The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its Pay...	3.7 Low	—	0,24%	10 Agt 2026
CVE-2026-17012 The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the...	5.3 Medium	—	0,29%	10 Agt 2026
CVE-2026-17010 The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-le...	5.4 Medium	—	0,23%	10 Agt 2026
CVE-2026-16985 The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allow...	8.8 High	—	0,73%	10 Agt 2026
CVE-2026-16949 The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to p...	5.8 Medium	—	0,35%	10 Agt 2026
CVE-2026-16299 The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of...	9.8 Critical	—	0,50%	10 Agt 2026
CVE-2026-16298 The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitra...	9.8 Critical	—	0,50%	10 Agt 2026
CVE-2026-16257 The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthe...	8.2 High	—	0,36%	10 Agt 2026
CVE-2026-15238 The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-pr...	5.4 Medium	—	0,23%	10 Agt 2026
CVE-2026-15237 The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing...	5.3 Medium	—	0,30%	10 Agt 2026
CVE-2026-15229 The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings...	5.3 Medium	—	0,30%	10 Agt 2026
CVE-2026-15047 The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with cont...	6.8 Medium	—	0,43%	10 Agt 2026
CVE-2026-14941 The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users...	5.4 Medium	—	0,23%	10 Agt 2026
CVE-2026-14860 The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated atta...	5.3 Medium	—	0,32%	10 Agt 2026
CVE-2026-14293 The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that va...	8.8 High	—	0,51%	10 Agt 2026
CVE-2026-14238 The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its...	4.1 Medium	—	0,31%	10 Agt 2026
CVE-2026-14237 The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset AP...	7.2 High	—	0,46%	10 Agt 2026
CVE-2026-14211 The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose r...	3.8 Low	—	0,26%	10 Agt 2026
CVE-2026-14206 The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated user...	7.5 High	—	0,43%	10 Agt 2026
CVE-2026-13701 The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow adm...	4.8 Medium	—	0,24%	10 Agt 2026
CVE-2026-13600 The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie...	8.1 High	—	0,47%	10 Agt 2026
CVE-2026-13170 The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level a...	7.2 High	—	0,57%	10 Agt 2026
CVE-2026-13133 A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL sear...	8.4 High	—	0,17%	10 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.