Katalog CVE (hal. 798)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.205 (Critical 36.640 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.851–39.900 dari 266.205 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-68075 apache qpid broker-j An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Broker-J: throug...	6.5 Medium	—	0,65%	5 Agt 2026
CVE-2026-68073 apache qpid broker-j A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-67592 apache qpid protonj2 It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potent...	7.5 High	—	0,74%	5 Agt 2026
CVE-2026-67591 apache qpid protonj2 An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: throug...	6.5 Medium	—	0,65%	5 Agt 2026
CVE-2026-67590 apache qpid protonj2 A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-67555 apache qpid proton-dotnet It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potent...	6.5 Medium	—	0,65%	5 Agt 2026
CVE-2026-67554 apache qpid proton-dotnet An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service...	6.5 Medium	—	0,65%	5 Agt 2026
CVE-2026-67553 apache qpid proton-dotnet An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: t...	6.5 Medium	—	0,65%	5 Agt 2026
CVE-2026-67552 apache qpid proton-dotnet A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-D...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-66277 apache qpid proton-j It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potent...	6.5 Medium	—	0,65%	5 Agt 2026
CVE-2026-66276 apache qpid proton-j An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service...	6.5 Medium	—	0,65%	5 Agt 2026
CVE-2026-66275 apache qpid proton-j An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-J: throug...	6.5 Medium	—	0,65%	5 Agt 2026
CVE-2026-66274 apache qpid proton-j A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-J...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-49004 The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, r...	6.5 Medium	—	1,2%	5 Agt 2026
CVE-2026-17515 The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allo...	4.3 Medium	—	0,16%	5 Agt 2026
CVE-2026-16993 The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relyi...	3.7 Low	—	0,27%	5 Agt 2026
CVE-2026-16981 The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one o...	5.3 Medium	—	0,32%	5 Agt 2026
CVE-2026-16968 The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor...	6.5 Medium	—	0,37%	5 Agt 2026
CVE-2026-16942 The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unf...	5.4 Medium	—	0,23%	5 Agt 2026
CVE-2026-16940 The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on t...	10.0 Critical	—	0,57%	5 Agt 2026
CVE-2026-16746 The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendo...	2.7 Low	—	0,30%	5 Agt 2026
CVE-2026-16736 The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions,...	7.5 High	—	0,41%	5 Agt 2026
CVE-2026-16613 The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-or...	4.3 Medium	—	0,17%	5 Agt 2026
CVE-2026-16605 The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an authenticated...	7.2 High	—	0,46%	5 Agt 2026
CVE-2026-16604 The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated u...	7.5 High	—	0,43%	5 Agt 2026
CVE-2026-16603 The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the f...	7.5 High	—	0,43%	5 Agt 2026
CVE-2026-16602 The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthentic...	7.5 High	—	0,43%	5 Agt 2026
CVE-2026-16583 The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG...	6.1 Medium	—	0,25%	5 Agt 2026
CVE-2026-16573 The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG fi...	7.5 High	—	0,37%	5 Agt 2026
CVE-2026-16561 The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the...	7.5 High	—	0,41%	5 Agt 2026
CVE-2026-16055 The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cooki...	7.5 High	—	0,42%	5 Agt 2026
CVE-2026-16036 The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's exist...	7.5 High	—	0,43%	5 Agt 2026
CVE-2026-15372 The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker...	7.5 High	—	0,52%	5 Agt 2026
CVE-2026-15360 The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to...	9.1 Critical	—	0,46%	5 Agt 2026
CVE-2026-15230 The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authentic...	8.1 High	—	0,35%	5 Agt 2026
CVE-2026-15210 The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login cod...	9.1 Critical	—	0,42%	5 Agt 2026
CVE-2026-14553 The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension...	8.1 High	—	0,61%	5 Agt 2026
CVE-2025-15677 The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privileg...	3.5 Low	—	0,24%	5 Agt 2026
CVE-2026-9273 The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in...	9.3 Critical	—	0,51%	5 Agt 2026
CVE-2026-8790 The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up to, an...	6.1 Medium	—	0,39%	5 Agt 2026
CVE-2026-8761 The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the `Cus...	8.8 High	—	0,69%	5 Agt 2026
CVE-2026-7753 The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculator-custom-e...	6.5 Medium	—	0,51%	5 Agt 2026
CVE-2026-71192 In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl...	6.0 Medium	—	0,44%	5 Agt 2026
CVE-2026-71191 In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attack...	6.0 Medium	—	0,56%	5 Agt 2026
CVE-2026-71190 In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" patte...	8.7 High	—	0,84%	5 Agt 2026
CVE-2026-68074 apache qpid broker-j A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Bro...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-68060 apache qpid broker-j A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpi...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-67589 apache qpid protonj2 A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpi...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-67588 apache qpid protonj2 A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Pro...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-67551 apache qpid proton-dotnet pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid...	7.5 High	—	0,77%	5 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.