Katalog CVE (hal. 804)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.205 (Critical 36.640 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.151–40.200 dari 266.205 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-16548 The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension,...	6.5 Medium	—	0,43%	4 Agt 2026
CVE-2026-16547 The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capabil...	5.9 Medium	—	0,39%	4 Agt 2026
CVE-2026-16546 The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being...	4.3 Medium	—	0,25%	4 Agt 2026
CVE-2026-16536 The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing una...	5.3 Medium	—	0,32%	4 Agt 2026
CVE-2026-16296 The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsa...	4.7 Medium	—	0,29%	4 Agt 2026
CVE-2026-16295 The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Su...	4.3 Medium	—	0,27%	4 Agt 2026
CVE-2026-16293 The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users wi...	6.8 Medium	—	0,43%	4 Agt 2026
CVE-2026-16070 The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request...	2.7 Low	—	0,28%	4 Agt 2026
CVE-2026-16069 The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them...	6.8 Medium	—	0,43%	4 Agt 2026
CVE-2026-16068 The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting...	3.5 Low	—	0,24%	4 Agt 2026
CVE-2026-16056 The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscri...	4.3 Medium	—	0,27%	4 Agt 2026
CVE-2026-16035 The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling...	4.3 Medium	—	0,33%	4 Agt 2026
CVE-2026-15958 The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also register...	9.3 Critical	—	0,35%	4 Agt 2026
CVE-2026-15233 The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allo...	4.8 Medium	—	0,24%	4 Agt 2026
CVE-2026-14939 The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor...	6.8 Medium	—	0,38%	4 Agt 2026
CVE-2026-14872 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL stateme...	6.8 Medium	—	0,39%	4 Agt 2026
CVE-2026-14848 The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to...	5.4 Medium	—	0,29%	4 Agt 2026
CVE-2026-14824 The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowin...	4.8 Medium	—	0,24%	4 Agt 2026
CVE-2026-14816 The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choic...	6.5 Medium	—	0,34%	4 Agt 2026
CVE-2026-12698 The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-le...	4.3 Medium	—	0,25%	4 Agt 2026
CVE-2026-11366 The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPr...	3.7 Low	—	0,25%	4 Agt 2026
CVE-2026-10526 The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthen...	5.8 Medium	—	0,33%	4 Agt 2026
CVE-2026-68744 fedoraproject sssd, redhat openshift container platform +1 lainnya A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet...	3.3 Low	—	0,13%	4 Agt 2026
CVE-2026-18739 A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or throug...	2.5 Low	—	0,14%	4 Agt 2026
CVE-2026-18569 redhat build of keycloak A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authenticat...	3.7 Low	—	0,25%	4 Agt 2026
CVE-2026-16881 A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externall...	8.7 High	—	0,44%	4 Agt 2026
CVE-2026-42169 redhat enterprise linux, redhat enterprise linux eus A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pi...	7.8 High	—	0,13%	4 Agt 2026
CVE-2026-18723 A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of t...	6.3 Medium	—	0,35%	4 Agt 2026
CVE-2026-18722 A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-sur...	6.3 Medium	—	0,37%	4 Agt 2026
CVE-2026-18721 A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login...	4.3 Medium	—	0,43%	4 Agt 2026
CVE-2026-14818 A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX ser...	7.2 High	—	0,57%	4 Agt 2026
CVE-2026-8508 An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WL...	6.5 Medium	—	0,32%	4 Agt 2026
CVE-2026-6837 A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticat...	7.2 High	—	1,5%	4 Agt 2026
CVE-2026-18720 A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarni...	5.3 Medium	—	0,48%	4 Agt 2026
CVE-2026-17614 A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deploy...	4.4 Medium	—	1,1%	4 Agt 2026
CVE-2026-18719 A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argu...	6.3 Medium	—	0,32%	4 Agt 2026
CVE-2026-58045 A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. Al...	6.2 Medium	—	0,17%	4 Agt 2026
CVE-2026-58044 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage`...	3.7 Low	—	0,27%	4 Agt 2026
CVE-2026-58042 A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can...	5.9 Medium	—	0,37%	4 Agt 2026
CVE-2026-58041 A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after i...	5.3 Medium	—	0,29%	4 Agt 2026
CVE-2026-56846 A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.j...	7.5 High	—	0,50%	4 Agt 2026
CVE-2026-56845 An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in th...	7.5 High	—	0,60%	4 Agt 2026
CVE-2026-66326 microsoft edge chromium Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	8.8 High	—	0,77%	4 Agt 2026
CVE-2026-66325 microsoft edge chromium Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.	6.1 Medium	—	0,39%	4 Agt 2026
CVE-2026-66322 microsoft edge chromium Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.	5.4 Medium	—	0,23%	4 Agt 2026
CVE-2026-66321 microsoft edge chromium Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	9.6 Critical	—	1,1%	4 Agt 2026
CVE-2026-66318 microsoft edge chromium Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.	8.1 High	—	0,36%	4 Agt 2026
CVE-2026-66317 microsoft edge chromium Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.	5.4 Medium	—	0,21%	4 Agt 2026
CVE-2026-66316 microsoft edge chromium Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.	5.4 Medium	—	0,21%	4 Agt 2026
CVE-2026-66315 microsoft edge chromium Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	7.5 High	—	0,61%	4 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.