Katalog CVE (hal. 817)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.209 (Critical 36.641 · High 106.361 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 1 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.801–40.850 dari 266.209 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2025-67650 An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into...	8.6 High	—	0,38%	31 Jul 2026
CVE-2025-67649 A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for s...	9.3 Critical	—	0,44%	31 Jul 2026
CVE-2026-64607 apache httpclient HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `...	5.3 Medium	—	0,46%	31 Jul 2026
CVE-2026-62391 apache kyuubi The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.se...	8.1 High	—	0,79%	31 Jul 2026
CVE-2026-44615 apache zeppelin Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folde...	6.5 Medium	—	0,81%	31 Jul 2026
CVE-2026-17567 The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all v...	5.3 Medium	—	0,63%	31 Jul 2026
CVE-2026-16843 Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit th...	7.2 High	—	0,92%	31 Jul 2026
CVE-2026-18437 The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the `mailerp...	5.3 Medium	—	0,39%	31 Jul 2026
CVE-2026-18436 The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint (POST /wp-...	5.3 Medium	—	0,39%	31 Jul 2026
CVE-2026-15722 redhat directory server, redhat 389 directory server +1 lainnya A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a netw...	7.5 High	—	0,83%	31 Jul 2026
CVE-2026-11770 redhat directory server, redhat 389 directory server +1 lainnya A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operati...	7.5 High	—	0,53%	31 Jul 2026
CVE-2026-10079 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on t...	8.5 High	—	0,19%	31 Jul 2026
CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential...	8.1 High	—	0,27%	31 Jul 2026
CVE-2026-65311 The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and tar...	5.3 Medium	—	0,46%	31 Jul 2026
CVE-2026-65310 ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and per...	7.5 High	—	0,50%	31 Jul 2026
CVE-2026-65309 ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows...	7.5 High	—	0,25%	31 Jul 2026
CVE-2026-18218 redhat build of keycloak A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (cl...	5.4 Medium	—	0,29%	31 Jul 2026
CVE-2026-18217 redhat build of keycloak A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML auth...	4.7 Medium	—	0,33%	31 Jul 2026
CVE-2026-18215 redhat build of keycloak Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restri...	8.1 High	—	0,40%	31 Jul 2026
CVE-2026-18214 redhat build of keycloak Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token e...	8.1 High	—	0,40%	31 Jul 2026
CVE-2026-18211 redhat build of keycloak A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on clie...	5.4 Medium	—	0,31%	31 Jul 2026
CVE-2026-18209 redhat build of keycloak A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check des...	4.7 Medium	—	0,41%	31 Jul 2026
CVE-2026-18208 redhat build of keycloak A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to s...	6.5 Medium	—	0,34%	31 Jul 2026
CVE-2026-18206 redhat build of keycloak A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses...	3.7 Low	—	0,32%	31 Jul 2026
CVE-2026-18203 redhat build of keycloak A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child g...	6.5 Medium	—	0,31%	31 Jul 2026
CVE-2026-16105 redhat build of keycloak A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce a...	4.9 Medium	—	0,42%	31 Jul 2026
CVE-2026-8155 The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to...	5.4 Medium	—	0,24%	31 Jul 2026
CVE-2026-18452 DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control...	10.0 Critical	—	0,63%	31 Jul 2026
CVE-2026-16236 The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and co...	8.8 High	—	1,2%	31 Jul 2026
CVE-2026-15381 The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perfor...	3.7 Low	—	0,29%	31 Jul 2026
CVE-2026-15258 The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL...	8.1 High	—	0,39%	31 Jul 2026
CVE-2026-15209 The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply anot...	6.5 Medium	—	0,34%	31 Jul 2026
CVE-2026-15048 The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history s...	7.5 High	—	0,43%	31 Jul 2026
CVE-2026-14931 The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-...	6.5 Medium	—	0,37%	31 Jul 2026
CVE-2026-14930 The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated...	7.5 High	—	0,41%	31 Jul 2026
CVE-2026-14929 The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above)...	4.3 Medium	—	0,25%	31 Jul 2026
CVE-2026-14928 The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler...	6.5 Medium	—	0,37%	31 Jul 2026
CVE-2026-14927 The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed...	3.7 Low	—	0,26%	31 Jul 2026
CVE-2026-14922 WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw i...	6.1 Medium	—	0,25%	31 Jul 2026
CVE-2026-14921 The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),	6.1 Medium	—	0,25%	31 Jul 2026
CVE-2026-14919 The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable wi...	9.8 Critical	—	0,50%	31 Jul 2026
CVE-2026-14862 The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the...	3.7 Low	—	0,26%	31 Jul 2026
CVE-2026-14849 The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads d...	3.7 Low	—	0,28%	31 Jul 2026
CVE-2026-14847 The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any auth...	4.3 Medium	—	0,27%	31 Jul 2026
CVE-2026-14845 The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it i...	6.1 Medium	—	0,28%	31 Jul 2026
CVE-2026-14843 The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-ch...	5.3 Medium	—	0,30%	31 Jul 2026
CVE-2026-14834 The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's c...	6.5 Medium	—	0,28%	31 Jul 2026
CVE-2026-14833 The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the br...	6.8 Medium	—	0,43%	31 Jul 2026
CVE-2026-14830 The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid,...	7.5 High	—	0,36%	31 Jul 2026
CVE-2026-14554 The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator...	6.5 Medium	—	1,4%	31 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.