Katalog CVE (hal. 775)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.701–38.750 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-17011 The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor...	3.8 Low	—	0,17%	9 Agt 2026
CVE-2026-16992 The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally pub...	6.5 Medium	—	0,28%	9 Agt 2026
CVE-2026-16988 The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthe...	7.5 High	—	0,43%	9 Agt 2026
CVE-2026-16965 The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscribe...	4.3 Medium	—	0,14%	9 Agt 2026
CVE-2026-16957 The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing user...	2.7 Low	—	0,30%	9 Agt 2026
CVE-2026-16032 The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering i...	6.1 Medium	—	0,28%	9 Agt 2026
CVE-2026-15038 The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint...	9.8 Critical	—	0,76%	9 Agt 2026
CVE-2026-19334 A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of...	5.3 Medium	—	1,1%	9 Agt 2026
CVE-2026-19333 A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03237d92f7dc2f0da0d70a87dba84ebcde5b66. Affected by this issue is some u...	5.3 Medium	—	1,1%	9 Agt 2026
CVE-2026-19332 A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component run_openlane/view_wavefor...	5.3 Medium	—	0,78%	9 Agt 2026
CVE-2026-19331 A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such...	5.3 Medium	—	0,20%	9 Agt 2026
CVE-2026-19330 A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function create_system_json/create_library to get_system_json/switc...	5.3 Medium	—	0,20%	9 Agt 2026
CVE-2026-19329 A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-proces...	5.3 Medium	—	0,78%	9 Agt 2026
CVE-2026-10595 A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability...	7.5 High	—	0,62%	9 Agt 2026
CVE-2026-19328 A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file...	5.3 Medium	—	0,17%	9 Agt 2026
CVE-2026-19327 A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a...	5.3 Medium	—	0,20%	9 Agt 2026
CVE-2026-19326 A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanag...	4.4 Medium	—	0,20%	9 Agt 2026
CVE-2026-19325 A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects the function...	5.3 Medium	—	0,20%	9 Agt 2026
CVE-2026-19324 A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of t...	3.3 Low	—	0,18%	9 Agt 2026
CVE-2026-17510 Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute. print_attribute() sizes t...	7.5 High	—	0,61%	9 Agt 2026
CVE-2026-71993 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary com...	9.8 Critical	—	2,5%	9 Agt 2026
CVE-2026-71992 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitrary c...	9.8 Critical	—	2,5%	9 Agt 2026
CVE-2026-71991 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote at...	9.8 Critical	—	2,5%	9 Agt 2026
CVE-2026-71990 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attac...	9.8 Critical	—	2,5%	9 Agt 2026
CVE-2026-71989 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary...	9.8 Critical	—	2,5%	9 Agt 2026
CVE-2026-71988 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary comm...	9.8 Critical	—	2,5%	9 Agt 2026
CVE-2026-71987 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary command...	9.8 Critical	—	2,5%	9 Agt 2026
CVE-2026-71986 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary command...	9.8 Critical	—	2,5%	9 Agt 2026
CVE-2026-71985 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitra...	9.8 Critical	—	2,5%	9 Agt 2026
CVE-2026-71984 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary c...	9.8 Critical	—	2,5%	9 Agt 2026
CVE-2026-19323 A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProj...	5.3 Medium	—	0,17%	9 Agt 2026
CVE-2026-71983 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary co...	9.8 Critical	—	2,5%	8 Agt 2026
CVE-2026-71502 CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-con...	5.1 Medium	—	0,74%	8 Agt 2026
CVE-2026-71958 D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A rem...	9.8 Critical	—	1,1%	8 Agt 2026
CVE-2026-71957 D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote att...	9.8 Critical	—	1,1%	8 Agt 2026
CVE-2026-71956 D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote a...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71955 D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71954 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3Conf...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71953 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interf...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71952 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPinManageS...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71951 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71950 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71949 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71948 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagn...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71947 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTraceroute...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71946 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagno...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71945 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpg...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-71944 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpg...	9.8 Critical	—	3,2%	8 Agt 2026
CVE-2026-67620 flowiseai flowise Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle...	7.7 High	—	0,46%	8 Agt 2026
CVE-2026-42170 redhat enterprise linux A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower...	7.8 High	—	0,19%	8 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.