Katalog CVE (hal. 788)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.187 (Critical 36.636 · High 106.360 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.351–39.400 dari 266.187 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-28140 Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.	7.5 High	—	0,35%	6 Agt 2026
CVE-2026-28139 Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.	9.8 Critical	—	0,56%	6 Agt 2026
CVE-2026-28111 Contributor Privilege Escalation in Forminator <= 1.56.0 versions.	8.8 High	—	0,42%	6 Agt 2026
CVE-2026-28082 Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.	7.1 High	—	0,25%	6 Agt 2026
CVE-2026-28005 Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.	9.8 Critical	—	0,48%	6 Agt 2026
CVE-2026-25403 Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.	6.5 Medium	—	0,27%	6 Agt 2026
CVE-2026-19045 A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDial...	5.3 Medium	—	0,78%	6 Agt 2026
CVE-2026-19044 A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_sce...	5.3 Medium	—	0,87%	6 Agt 2026
CVE-2026-15246 The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before g...	4.3 Medium	—	0,14%	6 Agt 2026
CVE-2025-49506 apache apr-util APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their co...	7.5 High	—	0,38%	6 Agt 2026
CVE-2026-64993 dell rvtools Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated attacker could potentially expl...	9.1 Critical	—	0,24%	6 Agt 2026
CVE-2026-5134 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injecti...	9.8 Critical	—	0,48%	6 Agt 2026
CVE-2026-19041 A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/p...	6.3 Medium	—	2,1%	6 Agt 2026
CVE-2026-19040 A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation c...	6.3 Medium	—	0,30%	6 Agt 2026
CVE-2026-18501 The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi...	6.4 Medium	—	0,26%	6 Agt 2026
CVE-2026-16731 OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthentica...	8.3 High	—	0,44%	6 Agt 2026
CVE-2026-16316 OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV frame can caus...	4.3 Medium	—	0,24%	6 Agt 2026
CVE-2026-16315 OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthentica...	8.7 High	—	0,42%	6 Agt 2026
CVE-2026-12605 eclipse glassfish In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is...	9.6 Critical	—	0,43%	6 Agt 2026
CVE-2026-70556 Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post() that al...	4.3 Medium	—	0,19%	6 Agt 2026
CVE-2026-66733 Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote atta...	7.5 High	—	1,6%	6 Agt 2026
CVE-2026-66732 Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-b...	5.9 Medium	—	0,17%	6 Agt 2026
CVE-2026-65551 Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a...	7.5 High	—	0,39%	6 Agt 2026
CVE-2026-19039 A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file src/index.ts...	5.3 Medium	—	0,85%	6 Agt 2026
CVE-2026-19038 A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function screenshotElement of the file src/index.ts of the co...	6.3 Medium	—	0,40%	6 Agt 2026
CVE-2026-19037 A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob of the file src/WtBtCore/MatchEngine.cpp of th...	4.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-19036 A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp...	7.2 High	—	3,2%	6 Agt 2026
CVE-2026-15599 Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. This issue affects pardus-doma...	3.3 Low	—	0,13%	6 Agt 2026
CVE-2026-0673 The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_cont...	5.3 Medium	—	0,35%	6 Agt 2026
CVE-2026-8166 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allow...	5.4 Medium	—	0,23%	6 Agt 2026
CVE-2026-68481 apache cxf In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies...	7.5 High	—	0,66%	6 Agt 2026
CVE-2026-68079 apache cxf In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the r...	9.8 Critical	—	0,68%	6 Agt 2026
CVE-2026-65583 apache cxf Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk bind...	9.1 Critical	—	0,28%	6 Agt 2026
CVE-2026-63687 apache cxf Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A clie...	9.1 Critical	—	0,28%	6 Agt 2026
CVE-2026-61466 apache cxf In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request ver...	9.1 Critical	—	0,71%	6 Agt 2026
CVE-2026-57818 apache cxf A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of m...	8.1 High	—	0,47%	6 Agt 2026
CVE-2026-5391 The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all vers...	6.4 Medium	—	0,26%	6 Agt 2026
CVE-2026-5158 The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' par...	6.4 Medium	—	0,26%	6 Agt 2026
CVE-2026-19035 A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the ar...	7.2 High	—	3,2%	6 Agt 2026
CVE-2026-11983 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capabi...	5.3 Medium	—	0,43%	6 Agt 2026
CVE-2025-9266 The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions...	4.3 Medium	—	0,26%	6 Agt 2026
CVE-2025-15028 The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form...	7.2 High	—	0,32%	6 Agt 2026
CVE-2026-66909 apache cxf Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able...	9.8 Critical	—	1,1%	6 Agt 2026
CVE-2026-65432 apache cxf Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> reference...	7.5 High	—	0,65%	6 Agt 2026
CVE-2026-64958 apache cxf An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers...	7.5 High	—	0,66%	6 Agt 2026
CVE-2026-57819 apache cxf Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is s...	7.5 High	—	0,73%	6 Agt 2026
CVE-2026-57817 apache cxf The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated w...	8.1 High	—	0,69%	6 Agt 2026
CVE-2026-54225 apache cxf Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on thi...	7.5 High	—	0,73%	6 Agt 2026
CVE-2026-19034 A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function new_qoslimit_stop of the file /tmp/qoslimittc_stop.sh. Executing...	7.2 High	—	3,2%	6 Agt 2026
CVE-2026-55980 A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-service condition.	5.5 Medium	—	0,14%	6 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.