Katalog CVE (hal. 773)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.601–38.650 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18030 The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions,...	8.1 High	—	0,38%	10 Agt 2026
CVE-2026-17542 The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such...	7.5 High	—	0,42%	10 Agt 2026
CVE-2026-17541 The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity...	7.5 High	—	0,43%	10 Agt 2026
CVE-2026-17540 The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read an...	8.8 High	—	1,8%	10 Agt 2026
CVE-2026-17023 The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization ca...	4.8 Medium	—	0,27%	10 Agt 2026
CVE-2026-17022 The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation ste...	7.5 High	—	0,43%	10 Agt 2026
CVE-2026-17021 The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership...	5.3 Medium	—	0,30%	10 Agt 2026
CVE-2026-17020 The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only...	4.3 Medium	—	0,27%	10 Agt 2026
CVE-2026-17019 The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them,...	6.1 Medium	—	0,28%	10 Agt 2026
CVE-2026-17018 The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of...	4.9 Medium	—	0,38%	10 Agt 2026
CVE-2026-17016 The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its Pay...	3.7 Low	—	0,24%	10 Agt 2026
CVE-2026-17012 The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the...	5.3 Medium	—	0,29%	10 Agt 2026
CVE-2026-17010 The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-le...	5.4 Medium	—	0,23%	10 Agt 2026
CVE-2026-16985 The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allow...	8.8 High	—	0,73%	10 Agt 2026
CVE-2026-16949 The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to p...	5.8 Medium	—	0,35%	10 Agt 2026
CVE-2026-16299 The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of...	9.8 Critical	—	0,50%	10 Agt 2026
CVE-2026-16298 The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitra...	9.8 Critical	—	0,50%	10 Agt 2026
CVE-2026-16257 The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthe...	8.2 High	—	0,36%	10 Agt 2026
CVE-2026-15238 The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-pr...	5.4 Medium	—	0,23%	10 Agt 2026
CVE-2026-15237 The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing...	5.3 Medium	—	0,30%	10 Agt 2026
CVE-2026-15229 The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings...	5.3 Medium	—	0,30%	10 Agt 2026
CVE-2026-15047 The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with cont...	6.8 Medium	—	0,43%	10 Agt 2026
CVE-2026-14941 The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users...	5.4 Medium	—	0,23%	10 Agt 2026
CVE-2026-14860 The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated atta...	5.3 Medium	—	0,32%	10 Agt 2026
CVE-2026-14293 The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that va...	8.8 High	—	0,51%	10 Agt 2026
CVE-2026-14238 The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its...	4.1 Medium	—	0,31%	10 Agt 2026
CVE-2026-14237 The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset AP...	7.2 High	—	0,46%	10 Agt 2026
CVE-2026-14211 The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose r...	3.8 Low	—	0,26%	10 Agt 2026
CVE-2026-14206 The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated user...	7.5 High	—	0,43%	10 Agt 2026
CVE-2026-13701 The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow adm...	4.8 Medium	—	0,24%	10 Agt 2026
CVE-2026-13600 The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie...	8.1 High	—	0,47%	10 Agt 2026
CVE-2026-13170 The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level a...	7.2 High	—	0,57%	10 Agt 2026
CVE-2026-13133 A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL sear...	8.4 High	—	0,17%	10 Agt 2026
CVE-2026-12971 The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the se...	2.2 Low	—	0,24%	10 Agt 2026
CVE-2026-12570 A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_mod...	5.5 Medium	—	0,19%	10 Agt 2026
CVE-2026-72522 libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in th...	6.2 Medium	—	0,19%	10 Agt 2026
CVE-2026-19389 Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF,...	7.1 High	—	0,44%	10 Agt 2026
CVE-2026-19387 A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per...	7.6 High	—	0,38%	10 Agt 2026
CVE-2026-19384 A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set...	7.3 High	—	0,32%	10 Agt 2026
CVE-2026-19383 A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/upload of t...	4.7 Medium	—	0,38%	10 Agt 2026
CVE-2026-19382 A weakness has been identified in Almico Speedfan 4.52. This affects the function KiSystemCall64 in the library speedfan.sys of the component MSR Index Handler. Executing...	2.3 Low	—	0,17%	10 Agt 2026
CVE-2026-19381 A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of th...	7.8 High	—	0,16%	10 Agt 2026
CVE-2026-19380 A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads...	2.3 Low	—	0,17%	10 Agt 2026
CVE-2026-19379 A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of th...	7.3 High	—	2,0%	10 Agt 2026
CVE-2026-19378 A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of t...	4.3 Medium	—	0,47%	10 Agt 2026
CVE-2026-19376 A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component Fil...	7.3 High	—	0,47%	10 Agt 2026
CVE-2026-19375 A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetch_article of the file news_scraper_mcp/server.py. The ma...	6.3 Medium	—	0,45%	10 Agt 2026
CVE-2026-19374 A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/pro...	7.3 High	—	0,50%	9 Agt 2026
CVE-2026-19373 A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component...	5.3 Medium	—	0,17%	9 Agt 2026
CVE-2026-19372 A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/in...	5.3 Medium	—	0,21%	9 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.