Katalog CVE (hal. 809)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.209 (Critical 36.641 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.401–40.450 dari 266.209 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-18590 A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. Thi...	6.3 Medium	—	1,8%	3 Agt 2026
CVE-2026-12259 nltk In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256...	6.5 Medium	—	0,10%	3 Agt 2026
CVE-2026-9593 A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the a...	6.7 Medium	—	0,17%	3 Agt 2026
CVE-2026-4793 synology assistant An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service...	7.3 High	—	0,15%	3 Agt 2026
CVE-2026-18589 A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passw...	9.8 Critical	—	1,1%	3 Agt 2026
CVE-2026-18588 A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH...	9.8 Critical	—	1,1%	3 Agt 2026
CVE-2026-18587 A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the ar...	7.5 High	—	2,0%	3 Agt 2026
CVE-2026-16572 The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perf...	8.6 High	—	0,45%	3 Agt 2026
CVE-2026-16565 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write en...	4.3 Medium	—	0,25%	3 Agt 2026
CVE-2026-16564 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk or...	4.3 Medium	—	0,25%	3 Agt 2026
CVE-2026-16563 The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing...	6.5 Medium	—	0,34%	3 Agt 2026
CVE-2026-16539 The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing use...	8.1 High	—	0,39%	3 Agt 2026
CVE-2026-16534 The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allo...	9.1 Critical	—	0,40%	3 Agt 2026
CVE-2026-16532 The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users...	9.1 Critical	—	0,46%	3 Agt 2026
CVE-2026-16300 The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary use...	9.8 Critical	—	0,50%	3 Agt 2026
CVE-2026-16297 The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access t...	4.1 Medium	—	0,37%	3 Agt 2026
CVE-2026-16289 The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user...	4.3 Medium	—	0,27%	3 Agt 2026
CVE-2026-16276 The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users w...	2.7 Low	—	0,30%	3 Agt 2026
CVE-2026-16274 The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users wit...	2.7 Low	—	0,30%	3 Agt 2026
CVE-2026-16250 The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated us...	9.8 Critical	—	0,83%	3 Agt 2026
CVE-2026-16060 The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable...	9.8 Critical	—	0,84%	3 Agt 2026
CVE-2026-16057 The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coars...	6.5 Medium	—	0,42%	3 Agt 2026
CVE-2026-15931 The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it whe...	6.1 Medium	—	0,28%	3 Agt 2026
CVE-2026-15930 The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to updat...	9.4 Critical	—	0,42%	3 Agt 2026
CVE-2026-15383 The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking RE...	6.1 Medium	—	0,28%	3 Agt 2026
CVE-2026-15260 The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-leve...	4.3 Medium	—	0,25%	3 Agt 2026
CVE-2026-15254 The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-use...	6.5 Medium	—	0,34%	3 Agt 2026
CVE-2026-15231 The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and ret...	2.7 Low	—	0,30%	3 Agt 2026
CVE-2026-14557 The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allow...	9.1 Critical	—	0,51%	3 Agt 2026
CVE-2026-13340 The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them a...	6.1 Medium	—	0,25%	3 Agt 2026
CVE-2026-12965 The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticat...	9.1 Critical	—	0,46%	3 Agt 2026
CVE-2026-12872 The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or non...	9.8 Critical	—	1,0%	3 Agt 2026
CVE-2025-15673 The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-priv...	4.9 Medium	—	0,47%	3 Agt 2026
CVE-2025-15672 The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers...	8.1 High	—	0,65%	3 Agt 2026
CVE-2026-6695 gimp, redhat enterprise linux A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerabili...	5.5 Medium	—	0,34%	3 Agt 2026
CVE-2026-6694 redhat enterprise linux A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an overs...	5.5 Medium	—	0,20%	3 Agt 2026
CVE-2026-18585 A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is...	4.3 Medium	—	0,51%	3 Agt 2026
CVE-2026-18584 A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of t...	5.4 Medium	—	0,35%	3 Agt 2026
CVE-2026-18583 A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms_mapping/mm...	5.3 Medium	—	0,86%	3 Agt 2026
CVE-2026-14682 bouncycastle bc-java, bouncycastle bctls-fips +2 lainnya In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS befor...	7.5 High	—	0,49%	3 Agt 2026
CVE-2026-13586 bouncycastle bc-java, bouncycastle bouncy castle for java lts +1 lainnya In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12,...	7.5 High	—	0,62%	3 Agt 2026
CVE-2026-13506 bouncycastle bc-java, bouncycastle bouncy castle for java lts +1 lainnya In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Boun...	7.5 High	—	0,49%	3 Agt 2026
CVE-2026-12860 bouncycastle bc-java, bouncycastle bouncy castle for java lts In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2...	5.3 Medium	—	0,17%	3 Agt 2026
CVE-2026-12852 bouncycastle bc-java In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.	7.5 High	—	0,49%	3 Agt 2026
CVE-2026-12817 bouncycastle bc-java, bouncycastle bcpg-fips +1 lainnya In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, a...	8.6 High	—	0,17%	3 Agt 2026
CVE-2026-12816 bouncycastle bc-java, bouncycastle bouncy castle for java lts In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...	7.5 High	—	0,18%	3 Agt 2026
CVE-2026-12803 bouncycastle bc-java, bouncycastle bouncy castle for java lts In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Ja...	7.5 High	—	0,24%	3 Agt 2026
CVE-2026-12802 bouncycastle bc-java, bouncycastle bcpkix-fips +1 lainnya In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12,...	7.5 High	—	0,20%	3 Agt 2026
CVE-2026-58063 bouncycastle bc-java, bouncycastle bouncy castle for java lts +1 lainnya In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73....	5.3 Medium	—	0,42%	3 Agt 2026
CVE-2026-58062 bouncycastle bc-java, bouncycastle bouncy castle for java lts +1 lainnya In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS befor...	9.1 Critical	—	0,36%	3 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.