Katalog CVE (hal. 799)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.205 (Critical 36.640 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 39.901–39.950 dari 266.205 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-67465 apache qpid proton-dotnet A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Pro...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-66839 NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An authenticated attacker may explo...	8.4 High	—	0,20%	5 Agt 2026
CVE-2026-66344 NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). An authenticated attacker may expl...	5.4 Medium	—	0,17%	5 Agt 2026
CVE-2026-66273 apache qpid proton-j A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpi...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-66257 apache qpid proton-j A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Pro...	7.5 High	—	0,77%	5 Agt 2026
CVE-2026-5062 The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' (sea...	4.9 Medium	—	0,44%	5 Agt 2026
CVE-2026-55707 In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another...	7.1 High	—	0,43%	5 Agt 2026
CVE-2026-18903 A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/co...	4.3 Medium	—	0,52%	5 Agt 2026
CVE-2026-18902 A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a m...	7.2 High	—	3,8%	5 Agt 2026
CVE-2026-18322 The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map coll...	8.8 High	—	0,59%	5 Agt 2026
CVE-2026-16143 The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkou...	7.2 High	—	0,41%	5 Agt 2026
CVE-2026-15941 The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler acce...	6.5 Medium	—	0,41%	5 Agt 2026
CVE-2026-15918 VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews...	7.5 High	—	0,54%	5 Agt 2026
CVE-2026-11421 The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all...	6.5 Medium	—	0,55%	5 Agt 2026
CVE-2026-18901 A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation le...	7.2 High	—	0,85%	5 Agt 2026
CVE-2026-18900 A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argu...	7.2 High	—	3,8%	5 Agt 2026
CVE-2026-18898 A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the a...	8.8 High	—	0,81%	5 Agt 2026
CVE-2026-18907 Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename.	7.5 High	—	0,91%	5 Agt 2026
CVE-2026-18897 A vulnerability was identified in UTT HiPER 1250GW up to v3.2.7-210907-180535. The impacted element is the function strcpy of the file /goform/getOneApConfTempEntry. The...	8.8 High	—	0,81%	5 Agt 2026
CVE-2026-18896 A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executi...	6.3 Medium	—	0,32%	5 Agt 2026
CVE-2026-18895 A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity_5g. Performing a manipulation of t...	8.8 High	—	0,81%	5 Agt 2026
CVE-2026-18859 A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the a...	7.3 High	—	0,41%	5 Agt 2026
CVE-2026-18856 A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.cont...	4.7 Medium	—	0,40%	5 Agt 2026
CVE-2026-46334 OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidt...	8.7 High	—	0,67%	5 Agt 2026
CVE-2026-45809 OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo...	8.7 High	—	0,64%	5 Agt 2026
CVE-2026-45705 OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body...	5.3 Medium	—	0,51%	5 Agt 2026
CVE-2026-18854 A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file...	7.3 High	—	0,41%	5 Agt 2026
CVE-2026-18853 A security vulnerability has been detected in ZomboDroid Meme Generator App 4.6830 on Android. This issue affects the function t5.l.c of the component com.zombodroid.Meme...	5.3 Medium	—	0,21%	5 Agt 2026
CVE-2026-18852 A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the...	3.3 Low	—	0,16%	5 Agt 2026
CVE-2026-18103 A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured wi...	4.9 Medium	—	0,71%	5 Agt 2026
CVE-2026-45537 OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI co...	9.1 Critical	—	0,63%	4 Agt 2026
CVE-2026-18819 A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation...	4.3 Medium	—	0,23%	4 Agt 2026
CVE-2026-18818 A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component...	6.3 Medium	—	0,37%	4 Agt 2026
CVE-2026-70620 Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network...	6.8 Medium	—	0,46%	4 Agt 2026
CVE-2026-70619 Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configurat...	8.8 High	—	0,66%	4 Agt 2026
CVE-2026-70594 Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixa...	6.7 Medium	—	0,24%	4 Agt 2026
CVE-2026-70593 Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads direct...	6.6 Medium	—	0,41%	4 Agt 2026
CVE-2026-70592 Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the d...	5.5 Medium	—	0,44%	4 Agt 2026
CVE-2026-70591 Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perfor...	4.1 Medium	—	0,37%	4 Agt 2026
CVE-2026-70590 Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API...	4.8 Medium	—	0,32%	4 Agt 2026
CVE-2026-70589 Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active....	4.8 Medium	—	0,27%	4 Agt 2026
CVE-2026-67862 open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c. This allows a remote attacker to cause a denial...	7.5 High	—	0,58%	4 Agt 2026
CVE-2026-67861 An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes component	7.5 High	—	0,75%	4 Agt 2026
CVE-2026-67860 open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend.	7.5 High	—	0,46%	4 Agt 2026
CVE-2026-67859 Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling.	7.5 High	—	0,82%	4 Agt 2026
CVE-2026-67858 Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. An unau...	7.5 High	—	0,86%	4 Agt 2026
CVE-2026-67857 open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.	7.5 High	—	0,63%	4 Agt 2026
CVE-2026-67856 An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItems(Sampling), Publish, Tr...	7.5 High	—	0,76%	4 Agt 2026
CVE-2026-67855 open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker...	7.5 High	—	0,51%	4 Agt 2026
CVE-2026-52370 A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the vict...	6.1 Medium	—	0,26%	4 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.