Katalog CVE (hal. 815)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.209 (Critical 36.641 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.701–40.750 dari 266.209 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-3141 The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments R...	9.1 Critical	—	0,90%	1 Agt 2026
CVE-2026-7623 The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' paramete...	6.4 Medium	—	0,36%	1 Agt 2026
CVE-2026-15414 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes(...	8.8 High	—	0,81%	1 Agt 2026
CVE-2026-15403 The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6....	4.9 Medium	—	0,44%	1 Agt 2026
CVE-2026-15006 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up t...	7.5 High	—	1,2%	1 Agt 2026
CVE-2026-13362 The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, and includin...	6.4 Medium	—	0,35%	1 Agt 2026
CVE-2026-9044 tp-link archer axe75 firmware An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbit...	8.0 High	—	2,5%	31 Jul 2026
CVE-2026-54909 pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE...	5.3 Medium	—	0,64%	31 Jul 2026
CVE-2026-54787 sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an...	3.1 Low	—	0,13%	31 Jul 2026
CVE-2026-54785 gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode...	6.2 Medium	—	0,19%	31 Jul 2026
CVE-2026-54768 WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller d...	6.9 Medium	—	0,45%	31 Jul 2026
CVE-2026-53573 GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuth...	4.8 Medium	—	0,65%	31 Jul 2026
CVE-2026-45377 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requir...	6.5 Medium	—	0,45%	31 Jul 2026
CVE-2026-45376 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search...	5.5 Medium	—	0,60%	31 Jul 2026
CVE-2026-45330 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin...	4.9 Medium	—	0,46%	31 Jul 2026
CVE-2026-34641 adobe premiere, adobe premiere pro Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this is...	7.8 High	—	0,26%	31 Jul 2026
CVE-2026-68771 ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python...	9.8 Critical	—	1,1%	31 Jul 2026
CVE-2026-52371 A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a cra...	6.5 Medium	—	0,40%	31 Jul 2026
CVE-2026-52232 A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Java...	6.1 Medium	—	0,25%	31 Jul 2026
CVE-2026-52134 An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame.	9.8 Critical	—	0,80%	31 Jul 2026
CVE-2026-51953 An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components	7.4 High	—	0,45%	31 Jul 2026
CVE-2026-45086 Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questio...	5.4 Medium	—	0,29%	31 Jul 2026
CVE-2026-68770 sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_...	9.8 Critical	—	0,91%	31 Jul 2026
CVE-2026-65981 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming...	7.1 High	—	0,39%	31 Jul 2026
CVE-2026-51785 An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request	9.8 Critical	—	1,1%	31 Jul 2026
CVE-2026-50986 PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An attacker ca...	8.8 High	—	0,21%	31 Jul 2026
CVE-2026-38713 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to conta...	9.8 Critical	—	2,8%	31 Jul 2026
CVE-2026-38710 TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to ex...	7.2 High	—	2,3%	31 Jul 2026
CVE-2026-38708 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to conta...	9.8 Critical	—	2,8%	31 Jul 2026
CVE-2025-69948 SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.	9.8 Critical	—	0,38%	31 Jul 2026
CVE-2025-69946 SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and ward_id.	9.8 Critical	—	0,42%	31 Jul 2026
CVE-2026-65841 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML...	5.3 Medium	—	0,53%	31 Jul 2026
CVE-2026-62999 Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a temp...	7.5 High	—	0,44%	31 Jul 2026
CVE-2026-62959 Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-...	8.2 High	—	0,52%	31 Jul 2026
CVE-2026-62324 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normaliz...	5.4 Medium	—	0,31%	31 Jul 2026
CVE-2026-55825 Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ se...	3.1 Low	—	0,30%	31 Jul 2026
CVE-2026-53599 REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an auth...	7.5 High	—	0,51%	31 Jul 2026
CVE-2026-53551 free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field...	6.9 Medium	—	0,74%	31 Jul 2026
CVE-2026-53510 Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module...	8.1 High	—	0,69%	31 Jul 2026
CVE-2026-38711 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to conta...	9.8 Critical	—	2,8%	31 Jul 2026
CVE-2026-18394 Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN...	7.4 High	—	0,52%	31 Jul 2026
CVE-2026-57232 Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReade...	3.1 Low	—	0,29%	31 Jul 2026
CVE-2026-55824 Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries...	2.6 Low	—	0,24%	31 Jul 2026
CVE-2026-53505 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> an...	7.5 High	—	0,61%	31 Jul 2026
CVE-2026-53504 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted rep...	7.5 High	—	0,61%	31 Jul 2026
CVE-2026-53503 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the u...	7.5 High	—	0,75%	31 Jul 2026
CVE-2026-53502 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allo...	8.7 High	—	0,52%	31 Jul 2026
CVE-2026-53501 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when remov...	8.2 High	—	0,35%	31 Jul 2026
CVE-2026-53500 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots...	8.2 High	—	0,50%	31 Jul 2026
CVE-2026-25552 Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarde...	3.7 Low	—	0,23%	31 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.