Katalog CVE (hal. 776)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.751–38.800 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-19288 A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-s...	5.3 Medium	—	0,20%	8 Agt 2026
CVE-2026-19287 A flaw has been found in abrinsmead mindpilot-mcp 0.5.0. Affected by this issue is some unknown functionality of the component HistoryService. This manipulation of the ar...	5.3 Medium	—	0,20%	8 Agt 2026
CVE-2026-19285 A vulnerability was detected in aaronsb memory-graph up to 5cfd2382778837b9f6399080956eee670d00452c. Affected by this vulnerability is the function JsonMemoryStorage.crea...	5.3 Medium	—	0,20%	8 Agt 2026
CVE-2026-19284 A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the compone...	5.3 Medium	—	0,78%	8 Agt 2026
CVE-2026-19282 A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolea...	5.3 Medium	—	1,1%	8 Agt 2026
CVE-2026-19281 A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of t...	5.3 Medium	—	0,78%	8 Agt 2026
CVE-2026-19279 A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the file src/index.ts. Such manipulation of the argument...	5.3 Medium	—	1,1%	8 Agt 2026
CVE-2026-68082 In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decode_lockers() decode_lockers() in cls_lock_client.c conta...	9.8 Critical	—	0,50%	8 Agt 2026
CVE-2026-19270 A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file src/...	5.3 Medium	—	0,20%	8 Agt 2026
CVE-2026-19268 A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the file src/se...	6.3 Medium	—	1,8%	8 Agt 2026
CVE-2026-19266 A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component rev...	5.5 Medium	—	3,9%	8 Agt 2026
CVE-2026-19263 A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge....	7.3 High	—	1,6%	8 Agt 2026
CVE-2026-19259 A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMapping_varAccessSpecToObjectReference of the file src/ie...	5.3 Medium	—	0,17%	8 Agt 2026
CVE-2026-16955 The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing u...	5.0 Medium	—	0,34%	8 Agt 2026
CVE-2026-16953 The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supp...	4.8 Medium	—	0,27%	8 Agt 2026
CVE-2026-16948 The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages r...	8.1 High	—	0,38%	8 Agt 2026
CVE-2026-16608 The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it...	5.3 Medium	—	0,30%	8 Agt 2026
CVE-2026-16595 The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated use...	6.5 Medium	—	0,37%	8 Agt 2026
CVE-2026-16594 The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated use...	7.5 High	—	0,42%	8 Agt 2026
CVE-2026-16590 The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated use...	6.5 Medium	—	0,37%	8 Agt 2026
CVE-2026-16589 The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actio...	7.7 High	—	0,37%	8 Agt 2026
CVE-2026-16578 The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST...	7.5 High	—	0,50%	8 Agt 2026
CVE-2026-16574 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting v...	5.4 Medium	—	0,23%	8 Agt 2026
CVE-2026-16562 The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every...	6.5 Medium	—	0,37%	8 Agt 2026
CVE-2026-16559 The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged user...	6.8 Medium	—	0,43%	8 Agt 2026
CVE-2026-16558 The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object...	5.4 Medium	—	0,23%	8 Agt 2026
CVE-2026-16535 The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to per...	6.1 Medium	—	0,51%	8 Agt 2026
CVE-2026-16282 The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing...	5.3 Medium	—	0,30%	8 Agt 2026
CVE-2026-16269 The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via...	4.8 Medium	—	0,36%	8 Agt 2026
CVE-2026-16267 The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticate...	8.1 High	—	0,45%	8 Agt 2026
CVE-2026-14526 The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not p...	9.8 Critical	—	0,91%	8 Agt 2026
CVE-2026-18988 The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8....	6.4 Medium	—	0,35%	8 Agt 2026
CVE-2026-13505 In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), sensitive key material held by the AES and D...	8.7 High	—	0,43%	8 Agt 2026
CVE-2026-8798 In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RD...	8.7 High	—	0,43%	8 Agt 2026
CVE-2026-52880 Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both...	7.5 High	—	0,49%	7 Agt 2026
CVE-2026-52879 Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for eve...	7.5 High	—	0,49%	7 Agt 2026
CVE-2026-52878 Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transac...	7.5 High	—	0,49%	7 Agt 2026
CVE-2026-49343 Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion f...	5.9 Medium	—	0,41%	7 Agt 2026
CVE-2026-48122 Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could o...	5.4 Medium	—	0,18%	7 Agt 2026
CVE-2026-48120 Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arb...	8.6 High	—	0,20%	7 Agt 2026
CVE-2026-48047 XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potentia...	5.9 Medium	—	0,65%	7 Agt 2026
CVE-2026-48026 lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise...	8.7 High	—	0,37%	7 Agt 2026
CVE-2026-47249 Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification....	7.5 High	—	0,49%	7 Agt 2026
CVE-2026-47127 Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/call...	6.5 Medium	—	0,34%	7 Agt 2026
CVE-2026-46409 OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an...	9.6 Critical	—	0,28%	7 Agt 2026
CVE-2026-64676 Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnera...	5.7 Medium	—	0,18%	7 Agt 2026
CVE-2026-58262 Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap t...	7.1 High	—	0,16%	7 Agt 2026
CVE-2026-48170 `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a ke...	9.1 Critical	—	0,40%	7 Agt 2026
CVE-2026-48169 PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. Th...	8.8 High	—	0,44%	7 Agt 2026
CVE-2026-47243 Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the r...	9.2 Critical	—	0,20%	7 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.