Katalog CVE (hal. 789)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.187 (Critical 36.636 · High 106.360 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.401–39.450 dari 266.187 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-55979 An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to operations...	5.2 Medium	—	0,13%	6 Agt 2026
CVE-2026-55978 An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication port and...	8.4 High	—	0,15%	6 Agt 2026
CVE-2026-64640 apache polaris Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a tabl...	6.5 Medium	—	0,49%	6 Agt 2026
CVE-2026-19022 A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This m...	6.3 Medium	—	1,8%	6 Agt 2026
CVE-2026-64601 In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmis...	7.8 High	—	0,17%	6 Agt 2026
CVE-2026-64599 In the Linux kernel, the following vulnerability has been resolved: crypto: amlogic - avoid double cleanup in meson_crypto_probe() When meson_allocate_chanlist() fails...	7.8 High	—	0,12%	6 Agt 2026
CVE-2026-64598 In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2_aead_req_alloc() The "num_sgs" variable is a u32 so "ERR_PTR(nu...	8.8 High	—	0,28%	6 Agt 2026
CVE-2026-64597 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayab...	9.8 Critical	—	0,36%	6 Agt 2026
CVE-2026-64588 In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring->ready On weakly-ordered architectures, the store to fiq->ops can...	7.8 High	—	0,17%	6 Agt 2026
CVE-2026-64587 In the Linux kernel, the following vulnerability has been resolved: net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Normal RX/TX interrupts are enabl...	7.0 High	—	0,16%	6 Agt 2026
CVE-2026-64586 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain bus_reset work on device removal brcmf_fw_crashed() and the debugfs "reset" en...	8.8 High	—	0,25%	6 Agt 2026
CVE-2026-64585 In the Linux kernel, the following vulnerability has been resolved: can: esd_usb: kill anchored URBs before freeing netdevs esd_usb_disconnect() frees each CAN netdev w...	7.8 High	—	0,12%	6 Agt 2026
CVE-2026-64584 In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: cancel pending IN work before freeing the midi object The f_midi driver embeds...	7.8 High	—	0,12%	6 Agt 2026
CVE-2026-64583 In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown The Broadcom BDC UDC driv...	7.8 High	—	0,12%	6 Agt 2026
CVE-2026-5430 Advisory wso2 api control plane, wso2 api manager +2 lainnya The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an...	10.0 Critical	KEV	22,4%	6 Agt 2026
CVE-2026-19021 A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file...	7.3 High	—	0,43%	6 Agt 2026
CVE-2026-19020 A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. Th...	6.3 Medium	—	0,33%	6 Agt 2026
CVE-2026-1728 wso2 api control plane, wso2 api manager +2 lainnya Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerabil...	9.8 Critical	—	0,48%	6 Agt 2026
CVE-2026-19019 A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager._setup_session_persistence of the file executor/app/core/...	4.8 Medium	—	0,49%	6 Agt 2026
CVE-2026-19011 A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Performing a mani...	5.3 Medium	—	0,54%	6 Agt 2026
CVE-2026-19010 A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component Message API...	7.3 High	—	0,50%	6 Agt 2026
CVE-2026-19009 A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endp...	7.3 High	—	0,51%	6 Agt 2026
CVE-2026-19008 A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the co...	6.3 Medium	—	0,44%	6 Agt 2026
CVE-2026-18915 Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting...	5.0 Medium	—	0,14%	6 Agt 2026
CVE-2026-18649 A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassemb...	7.5 High	—	0,96%	6 Agt 2026
CVE-2026-18597 The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulner...	8.5 High	—	0,31%	6 Agt 2026
CVE-2026-0637 wso2 api control plane, wso2 api manager +6 lainnya When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient valida...	4.4 Medium	—	0,16%	6 Agt 2026
CVE-2025-15039 wso2 api control plane, wso2 api manager +7 lainnya The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step...	9.4 Critical	—	0,67%	6 Agt 2026
CVE-2025-14779 wso2 identity server The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce...	3.8 Low	—	0,32%	6 Agt 2026
CVE-2025-13909 wso2 identity server The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenti...	4.3 Medium	—	0,35%	6 Agt 2026
CVE-2025-13736 wso2 api manager, wso2 identity server +3 lainnya When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays th...	3.7 Low	—	0,27%	6 Agt 2026
CVE-2025-13394 wso2 api control plane, wso2 api manager +7 lainnya The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utiliz...	5.4 Medium	—	0,14%	6 Agt 2026
CVE-2025-12627 wso2 identity server The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtaine...	2.4 Low	—	0,20%	6 Agt 2026
CVE-2025-11850 wso2 identity server When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store durin...	4.3 Medium	—	0,31%	6 Agt 2026
CVE-2024-8995 wso2 api control plane, wso2 api manager +6 lainnya Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling...	4.9 Medium	—	0,19%	6 Agt 2026
CVE-2024-6832 wso2 api control plane, wso2 api manager +6 lainnya The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it ca...	7.5 High	—	0,41%	6 Agt 2026
CVE-2024-10302 wso2 api control plane, wso2 api manager +5 lainnya The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included withi...	5.8 Medium	—	0,29%	6 Agt 2026
CVE-2026-19007 A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply...	6.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-19006 A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval...	6.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-19005 A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the c...	6.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-18967 redhat build of keycloak, redhat jboss enterprise application platform expansion pack A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keyc...	8.1 High	—	0,23%	6 Agt 2026
CVE-2026-18510 The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded g...	7.2 High	—	0,40%	6 Agt 2026
CVE-2026-18400 The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setti...	6.4 Medium	—	0,44%	6 Agt 2026
CVE-2026-18395 The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with...	5.4 Medium	—	0,23%	6 Agt 2026
CVE-2026-18050 The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthentic...	7.5 High	—	0,43%	6 Agt 2026
CVE-2026-16954 The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with t...	6.5 Medium	—	0,43%	6 Agt 2026
CVE-2026-16734 The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated pa...	7.5 High	—	0,35%	6 Agt 2026
CVE-2026-16537 The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the...	5.4 Medium	—	0,23%	6 Agt 2026
CVE-2026-16290 The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticat...	5.3 Medium	—	0,35%	6 Agt 2026
CVE-2026-16268 The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowin...	8.2 High	—	0,73%	6 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.