Katalog CVE (hal. 790)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.187 (Critical 36.636 · High 106.360 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.451–39.500 dari 266.187 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-16065 The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing use...	6.5 Medium	—	0,40%	6 Agt 2026
CVE-2026-16054 The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only...	9.1 Critical	—	0,49%	6 Agt 2026
CVE-2026-14829 The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management f...	8.2 High	—	0,33%	6 Agt 2026
CVE-2026-14547 The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form,...	5.3 Medium	—	0,30%	6 Agt 2026
CVE-2026-14314 The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token,...	5.3 Medium	—	0,32%	6 Agt 2026
CVE-2026-14313 PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), all versions...	5.3 Medium	—	0,16%	6 Agt 2026
CVE-2026-14240 The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control,...	5.3 Medium	—	0,35%	6 Agt 2026
CVE-2026-14204 The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into ove...	6.5 Medium	—	0,18%	6 Agt 2026
CVE-2026-13703 The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as...	5.4 Medium	—	0,23%	6 Agt 2026
CVE-2026-13154 The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its pu...	7.5 High	—	0,43%	6 Agt 2026
CVE-2026-13153 The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-prod...	7.5 High	—	1,5%	6 Agt 2026
CVE-2026-12713 The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated use...	9.1 Critical	—	0,46%	6 Agt 2026
CVE-2026-11588 The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the...	6.1 Medium	—	0,28%	6 Agt 2026
CVE-2025-15678 The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowi...	6.1 Medium	—	0,25%	6 Agt 2026
CVE-2026-19000 A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachme...	7.3 High	—	0,50%	6 Agt 2026
CVE-2026-18998 A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component de...	6.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-18997 A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the compo...	6.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-15459 The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV...	8.1 High	—	0,87%	6 Agt 2026
CVE-2026-18996 A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src...	6.3 Medium	—	0,43%	6 Agt 2026
CVE-2026-18995 A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the...	4.3 Medium	—	0,49%	6 Agt 2026
CVE-2026-18993 A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of th...	6.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-18992 A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function _select_tools of the file agent/evolution/executor.py of the compon...	6.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-18909 A stack-based buffer overflow vulnerability exists in ELAN Microelectronics Corp. ELAN Smart-Pad on Windows (ETD.sys and ETDSMBus.sys). During Intel SMBus recovery, ETDSM...	4.7 Medium	—	0,11%	6 Agt 2026
CVE-2026-18325 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Sel...	7.2 High	—	0,48%	6 Agt 2026
CVE-2026-16636 The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripti...	7.2 High	—	0,53%	6 Agt 2026
CVE-2026-15991 The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0...	8.8 High	—	1,1%	6 Agt 2026
CVE-2026-18991 A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the...	7.3 High	—	0,62%	6 Agt 2026
CVE-2026-18990 A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation...	7.3 High	—	0,69%	6 Agt 2026
CVE-2026-18980 A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classify_command_risk of the file src/tools/builtin/shell.rs. Such manipulation l...	6.3 Medium	—	1,6%	6 Agt 2026
CVE-2026-18976 A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the component...	6.3 Medium	—	0,37%	6 Agt 2026
CVE-2026-18974 A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execute_tool_manu...	5.3 Medium	—	0,53%	6 Agt 2026
CVE-2026-18973 A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the component...	7.3 High	—	0,51%	6 Agt 2026
CVE-2026-67873 A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only th...	9.8 Critical	—	0,73%	6 Agt 2026
CVE-2026-67872 An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling	7.5 High	—	0,51%	6 Agt 2026
CVE-2026-67871 Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, address_space_bs.c, sopc_node_mgt_helper_int...	7.5 High	—	0,82%	6 Agt 2026
CVE-2026-67870 In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send...	9.8 Critical	—	1,1%	6 Agt 2026
CVE-2026-67869 Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates input arguments against runtime-res...	7.5 High	—	0,82%	6 Agt 2026
CVE-2026-67531 FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances...	9.3 Critical	—	0,74%	6 Agt 2026
CVE-2026-52466 Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Control...	9.8 Critical	—	0,48%	6 Agt 2026
CVE-2026-19028 H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buff...	6.8 Medium	—	0,20%	6 Agt 2026
CVE-2026-19027 The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read ind...	6.9 Medium	—	0,20%	6 Agt 2026
CVE-2026-18970 A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/...	7.3 High	—	0,41%	6 Agt 2026
CVE-2026-18969 A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/useri...	7.3 High	—	0,47%	6 Agt 2026
CVE-2026-18968 A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags...	4.3 Medium	—	0,45%	6 Agt 2026
CVE-2026-67867 Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper when processing PublishRespon...	7.5 High	—	0,54%	5 Agt 2026
CVE-2026-67866 Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse a...	7.5 High	—	0,82%	5 Agt 2026
CVE-2026-67863 In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the...	7.5 High	—	0,74%	5 Agt 2026
CVE-2026-19026 H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at...	6.8 Medium	—	0,20%	5 Agt 2026
CVE-2026-19025 H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an e...	6.8 Medium	—	0,17%	5 Agt 2026
CVE-2026-19024 NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has...	8.2 High	—	0,19%	5 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.