Katalog CVE (hal. 780)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 38.951–39.000 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-9169 DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by...	8.8 High	—	0,17%	7 Agt 2026
CVE-2026-66493 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path tr...	6.4 Medium	—	0,47%	7 Agt 2026
CVE-2026-66492 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversa...	6.1 Medium	—	0,56%	7 Agt 2026
CVE-2026-66491 Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read v...	8.2 High	—	0,47%	7 Agt 2026
CVE-2026-49008 By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function o...	6.5 Medium	—	0,30%	7 Agt 2026
CVE-2026-18938 A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending speci...	6.2 Medium	—	0,11%	7 Agt 2026
CVE-2026-49007 By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.	7.5 High	—	0,43%	7 Agt 2026
CVE-2026-49006 By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.	5.3 Medium	—	0,25%	7 Agt 2026
CVE-2026-19079 A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore,...	4.4 Medium	—	0,11%	7 Agt 2026
CVE-2026-16027 Server-Side request forgery (SSRF) vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery. This issue affects Türkiye's E-Signa...	5.4 Medium	—	0,24%	7 Agt 2026
CVE-2026-15239 The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminat...	5.3 Medium	—	0,16%	7 Agt 2026
CVE-2026-15211 The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the Wo...	5.9 Medium	—	0,16%	7 Agt 2026
CVE-2026-15148 The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that...	5.3 Medium	—	0,16%	7 Agt 2026
CVE-2026-12261 nltk A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into s...	6.5 Medium	—	0,21%	7 Agt 2026
CVE-2026-19196 A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulati...	7.3 High	—	0,43%	7 Agt 2026
CVE-2026-16265 The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing user...	6.5 Medium	—	0,41%	7 Agt 2026
CVE-2026-16263 The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before usi...	8.8 High	—	0,54%	7 Agt 2026
CVE-2026-16262 The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacke...	7.5 High	—	0,23%	7 Agt 2026
CVE-2026-16258 The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Inj...	9.8 Critical	—	0,85%	7 Agt 2026
CVE-2026-16041 The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthen...	7.5 High	—	0,36%	7 Agt 2026
CVE-2026-16039 The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscri...	6.5 Medium	—	0,34%	7 Agt 2026
CVE-2026-16038 The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion e...	9.1 Critical	—	0,42%	7 Agt 2026
CVE-2026-16030 The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing una...	8.1 High	—	0,38%	7 Agt 2026
CVE-2026-15386 The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries,...	5.4 Medium	—	0,23%	7 Agt 2026
CVE-2026-15361 The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before...	8.1 High	—	0,39%	7 Agt 2026
CVE-2026-15359 The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the adm...	6.5 Medium	—	0,34%	7 Agt 2026
CVE-2026-15245 The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allo...	5.4 Medium	—	0,23%	7 Agt 2026
CVE-2026-15215 The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce Wor...	8.8 High	—	0,64%	7 Agt 2026
CVE-2026-15214 The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowi...	4.3 Medium	—	0,27%	7 Agt 2026
CVE-2026-15032 The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to...	6.1 Medium	—	0,28%	7 Agt 2026
CVE-2026-14943 The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated...	7.5 High	—	0,44%	7 Agt 2026
CVE-2026-14331 The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cr...	6.1 Medium	—	0,25%	7 Agt 2026
CVE-2026-14205 The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-co...	9.8 Critical	—	0,48%	7 Agt 2026
CVE-2026-49005 The root password hash of the device can be obtained through unencrypted information in the firmware.	2.4 Low	—	0,16%	7 Agt 2026
CVE-2026-19195 A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver...	7.8 High	—	0,16%	7 Agt 2026
CVE-2026-19193 A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Executing a man...	7.8 High	—	0,16%	7 Agt 2026
CVE-2026-19192 A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCoolDisplaySe...	7.8 High	—	0,16%	7 Agt 2026
CVE-2026-19191 A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\Dr...	7.8 High	—	0,16%	7 Agt 2026
CVE-2026-14365 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is...	9.8 Critical	—	0,56%	7 Agt 2026
CVE-2026-14364 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up...	9.8 Critical	—	0,51%	7 Agt 2026
CVE-2026-12801 The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in...	6.4 Medium	—	0,26%	7 Agt 2026
CVE-2026-11907 The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a...	6.5 Medium	—	0,38%	7 Agt 2026
CVE-2026-19190 A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scanner.Service...	7.8 High	—	0,16%	7 Agt 2026
CVE-2026-49746 Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arb...	7.1 High	—	0,15%	7 Agt 2026
CVE-2026-45204 Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. N...	5.5 Medium	—	0,15%	7 Agt 2026
CVE-2026-45198 Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure...	7.8 High	—	0,18%	7 Agt 2026
CVE-2026-19189 A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\Windows\System32\drivers\scd...	7.8 High	—	0,16%	7 Agt 2026
CVE-2026-70332 microsoft sharepoint online Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing ov...	9.6 Critical	—	0,86%	7 Agt 2026
CVE-2026-68823 microsoft azure confidential ledger Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.	9.1 Critical	—	0,93%	7 Agt 2026
CVE-2026-65668 microsoft purview ediscovery Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.	8.8 High	—	0,78%	7 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.