Katalog CVE (hal. 774)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.651–38.700 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-19371 A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component comfy_upload...	5.3 Medium	—	0,20%	9 Agt 2026
CVE-2026-12372 nltk A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function,...	3.7 Low	—	0,26%	9 Agt 2026
CVE-2026-19370 A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the comp...	5.3 Medium	—	0,17%	9 Agt 2026
CVE-2026-19369 A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component add_attachment_from_public_url...	5.3 Medium	—	0,15%	9 Agt 2026
CVE-2026-19368 A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the component...	3.3 Low	—	0,17%	9 Agt 2026
CVE-2026-19367 A vulnerability has been found in NocteDefensor LudusMCP 1.0.24. Affected by this vulnerability is an unknown functionality of the file src/tools/rangeConfig.ts of the co...	6.3 Medium	—	0,26%	9 Agt 2026
CVE-2026-70395 Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name,...	2.1 Low	—	0,20%	9 Agt 2026
CVE-2026-19366 A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insert_cred...	5.3 Medium	—	0,21%	9 Agt 2026
CVE-2026-19365 A vulnerability was identified in Ichigo3766 image-gen-mcp 0.1.0. The impacted element is an unknown function of the file src/index.ts of the component upscale_images. Su...	5.3 Medium	—	0,20%	9 Agt 2026
CVE-2026-69659 ash-hq ash framework Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read acti...	5.5 Medium	—	0,36%	9 Agt 2026
CVE-2026-19364 A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. T...	6.3 Medium	—	0,33%	9 Agt 2026
CVE-2026-19363 A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The mani...	5.3 Medium	—	0,67%	9 Agt 2026
CVE-2026-19362 A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parse_token_from_header of the file src/parse_token_from_header.rs of th...	5.3 Medium	—	0,64%	9 Agt 2026
CVE-2026-19361 A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a ma...	3.7 Low	—	0,44%	9 Agt 2026
CVE-2026-15534 Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex eng...	5.7 Medium	—	0,16%	9 Agt 2026
CVE-2026-19360 A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Handler. Perfor...	4.7 Medium	—	0,38%	9 Agt 2026
CVE-2026-19359 A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Fun...	4.7 Medium	—	0,38%	9 Agt 2026
CVE-2026-19358 A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes improper access...	6.3 Medium	—	0,35%	9 Agt 2026
CVE-2026-19357 A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation re...	5.3 Medium	—	0,48%	9 Agt 2026
CVE-2026-19356 A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation...	5.3 Medium	—	0,48%	9 Agt 2026
CVE-2026-19355 A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component...	7.3 High	—	0,41%	9 Agt 2026
CVE-2026-19354 A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/m...	6.3 Medium	—	0,32%	9 Agt 2026
CVE-2026-19353 A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component Installation...	5.0 Medium	—	0,38%	9 Agt 2026
CVE-2026-19352 A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component...	3.1 Low	—	0,30%	9 Agt 2026
CVE-2026-19351 A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the...	7.3 High	—	0,53%	9 Agt 2026
CVE-2026-19350 A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such ma...	6.3 Medium	—	0,26%	9 Agt 2026
CVE-2026-19348 A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter...	9.8 Critical	—	3,6%	9 Agt 2026
CVE-2026-19347 A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdoctor.php. Such manipulation o...	6.3 Medium	—	0,33%	9 Agt 2026
CVE-2026-19346 A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the...	8.8 High	—	2,7%	9 Agt 2026
CVE-2026-19345 A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argume...	6.5 Medium	—	0,55%	9 Agt 2026
CVE-2026-19344 A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/comment_count_user.php....	7.3 High	—	0,43%	9 Agt 2026
CVE-2026-19343 A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing...	7.3 High	—	0,43%	9 Agt 2026
CVE-2026-19342 A vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a mani...	7.3 High	—	0,67%	9 Agt 2026
CVE-2026-19341 A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Such manipula...	8.8 High	—	0,60%	9 Agt 2026
CVE-2026-19340 A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/complete_backend.js of the component Webh...	6.3 Medium	—	0,35%	9 Agt 2026
CVE-2026-19339 A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file s...	6.3 Medium	—	0,37%	9 Agt 2026
CVE-2026-19338 A vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4. The affected element is the function processGenerateRequest of the file mcp_servers/mermaid/ind...	5.3 Medium	—	0,17%	9 Agt 2026
CVE-2026-19337 A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component read_webpage. Executing...	5.3 Medium	—	0,17%	9 Agt 2026
CVE-2026-19336 A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Per...	5.3 Medium	—	0,20%	9 Agt 2026
CVE-2026-19335 A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/conf...	5.3 Medium	—	0,25%	9 Agt 2026
CVE-2026-18603 The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a pre...	6.5 Medium	—	0,30%	9 Agt 2026
CVE-2026-18473 The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploi...	9.1 Critical	—	0,46%	9 Agt 2026
CVE-2026-18465 The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does n...	6.5 Medium	—	0,34%	9 Agt 2026
CVE-2026-18464 The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does n...	7.5 High	—	0,48%	9 Agt 2026
CVE-2026-18357 The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated...	7.5 High	—	0,43%	9 Agt 2026
CVE-2026-18037 The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additiona...	6.5 Medium	—	0,28%	9 Agt 2026
CVE-2026-18032 The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that a...	7.5 High	—	0,43%	9 Agt 2026
CVE-2026-17044 The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection ex...	8.6 High	—	0,45%	9 Agt 2026
CVE-2026-17017 The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does...	8.1 High	—	0,39%	9 Agt 2026
CVE-2026-17014 The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthentic...	5.3 Medium	—	0,32%	9 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.