Katalog CVE (hal. 784)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.172 (Critical 36.633 · High 106.354 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.151–39.200 dari 266.172 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-19148 google chrome Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a s...	8.3 High	—	0,30%	6 Agt 2026
CVE-2026-19147 google chrome Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb...	8.3 High	—	0,30%	6 Agt 2026
CVE-2026-19146 google chrome Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sens...	5.3 Medium	—	0,31%	6 Agt 2026
CVE-2026-19145 google chrome Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromi...	8.8 High	—	0,41%	6 Agt 2026
CVE-2026-19144 google chrome Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium securi...	8.8 High	—	0,35%	6 Agt 2026
CVE-2026-19143 google chrome Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a sandbox escape...	8.6 High	—	0,13%	6 Agt 2026
CVE-2026-19142 google chrome Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit h...	7.5 High	—	0,30%	6 Agt 2026
CVE-2026-19141 google chrome Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform...	8.3 High	—	0,30%	6 Agt 2026
CVE-2026-19140 google chrome Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape...	8.3 High	—	0,30%	6 Agt 2026
CVE-2026-19139 google chrome Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Ch...	7.4 High	—	0,09%	6 Agt 2026
CVE-2026-19138 google chrome Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform...	8.3 High	—	0,33%	6 Agt 2026
CVE-2026-19137 google chrome Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sa...	8.3 High	—	0,30%	6 Agt 2026
CVE-2026-19127 An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic valid...	6.5 Medium	—	0,31%	6 Agt 2026
CVE-2026-19111 Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authent...	8.1 High	—	0,52%	6 Agt 2026
CVE-2026-19110 A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRend...	2.4 Low	—	0,35%	6 Agt 2026
CVE-2026-19108 A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/m...	5.3 Medium	—	0,16%	6 Agt 2026
CVE-2026-19071 A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of the argument...	6.3 Medium	—	0,33%	6 Agt 2026
CVE-2026-19070 A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of the argument...	6.3 Medium	—	0,33%	6 Agt 2026
CVE-2026-19069 A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. The manipula...	6.3 Medium	—	0,33%	6 Agt 2026
CVE-2026-19068 A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /treatmentdetail.php. Executing a m...	6.3 Medium	—	0,33%	6 Agt 2026
CVE-2026-19067 A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a m...	6.3 Medium	—	0,33%	6 Agt 2026
CVE-2026-19066 A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file view_students.php. Such...	4.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-19065 A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file upload_files....	6.3 Medium	—	0,35%	6 Agt 2026
CVE-2026-19064 A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php. The manipu...	4.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-19062 A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The m...	7.3 High	—	0,41%	6 Agt 2026
CVE-2026-19061 A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update H...	3.7 Low	—	0,22%	6 Agt 2026
CVE-2026-19060 A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to b...	5.3 Medium	—	0,20%	6 Agt 2026
CVE-2026-19059 A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes...	3.3 Low	—	0,21%	6 Agt 2026
CVE-2026-19058 A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function DataInterpreter of the file metagpt/roles/di/data_interpreter.py....	5.3 Medium	—	0,20%	6 Agt 2026
CVE-2026-19054 A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/dele...	5.3 Medium	—	0,17%	6 Agt 2026
CVE-2026-18487 A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specia...	5.4 Medium	—	0,34%	6 Agt 2026
CVE-2026-18367 A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for ma...	9.3 Critical	—	0,18%	6 Agt 2026
CVE-2026-17032 Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-...	9.8 Critical	—	0,55%	6 Agt 2026
CVE-2026-16620 The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, all...	7.5 High	—	0,37%	6 Agt 2026
CVE-2026-16619 The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied ident...	7.5 High	—	0,32%	6 Agt 2026
CVE-2026-16067 The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkou...	5.3 Medium	—	0,32%	6 Agt 2026
CVE-2026-15734 A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root.	9.8 Critical	—	0,77%	6 Agt 2026
CVE-2026-15733 A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitr...	9.8 Critical	—	10,0%	6 Agt 2026
CVE-2026-15732 A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitr...	9.8 Critical	—	0,56%	6 Agt 2026
CVE-2026-15256 The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed...	4.8 Medium	—	0,24%	6 Agt 2026
CVE-2026-15208 The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is...	5.3 Medium	—	0,16%	6 Agt 2026
CVE-2026-15152 The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that...	5.3 Medium	—	0,16%	6 Agt 2026
CVE-2026-15149 The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies...	5.3 Medium	—	0,32%	6 Agt 2026
CVE-2026-15147 The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment r...	5.3 Medium	—	0,16%	6 Agt 2026
CVE-2026-14936 The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activ...	5.3 Medium	—	0,16%	6 Agt 2026
CVE-2026-14842 The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers t...	5.3 Medium	—	0,30%	6 Agt 2026
CVE-2026-14831 The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and cal...	5.3 Medium	—	0,32%	6 Agt 2026
CVE-2026-14812 The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote c...	10.0 Critical	—	0,83%	6 Agt 2026
CVE-2026-14306 The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with su...	4.3 Medium	—	0,27%	6 Agt 2026
CVE-2026-14225 The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of th...	2.7 Low	—	0,32%	6 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.