Katalog CVE (hal. 824)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.229 (Critical 36.653 · High 106.363 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 41.151–41.200 dari 266.229 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15235 The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX action...	4.3 Medium	—	0,30%	30 Jul 2026
CVE-2026-15153 The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing u...	6.8 Medium	—	0,39%	30 Jul 2026
CVE-2026-15054 The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to su...	3.7 Low	—	0,25%	30 Jul 2026
CVE-2026-14923 The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because...	6.5 Medium	—	0,34%	30 Jul 2026
CVE-2026-14602 The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitra...	9.0 Critical	—	0,67%	30 Jul 2026
CVE-2026-14592 The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not e...	6.1 Medium	—	0,28%	30 Jul 2026
CVE-2026-14318 The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Work...	6.8 Medium	—	0,43%	30 Jul 2026
CVE-2026-14310 The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thr...	5.4 Medium	—	0,23%	30 Jul 2026
CVE-2026-14305 The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post...	5.3 Medium	—	0,30%	30 Jul 2026
CVE-2026-14239 The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that la...	7.1 High	—	0,14%	30 Jul 2026
CVE-2026-14231 The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, a...	4.3 Medium	—	0,30%	30 Jul 2026
CVE-2026-14226 The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a...	4.3 Medium	—	0,30%	30 Jul 2026
CVE-2026-14223 The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level...	4.3 Medium	—	0,27%	30 Jul 2026
CVE-2026-14222 The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contri...	3.8 Low	—	0,32%	30 Jul 2026
CVE-2026-14221 The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any a...	3.8 Low	—	0,26%	30 Jul 2026
CVE-2026-14207 The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a...	6.1 Medium	—	0,25%	30 Jul 2026
CVE-2026-14188 The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authentic...	2.7 Low	—	0,32%	30 Jul 2026
CVE-2026-13395 The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated f...	8.6 High	—	0,45%	30 Jul 2026
CVE-2026-13345 The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its...	5.3 Medium	—	0,32%	30 Jul 2026
CVE-2026-13344 The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing us...	4.8 Medium	—	0,24%	30 Jul 2026
CVE-2026-13330 The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing u...	6.1 Medium	—	0,25%	30 Jul 2026
CVE-2026-13178 The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to cr...	7.5 High	—	0,36%	30 Jul 2026
CVE-2026-13145 The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logge...	4.3 Medium	—	0,27%	30 Jul 2026
CVE-2026-13143 The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, a...	5.3 Medium	—	0,30%	30 Jul 2026
CVE-2026-12687 The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthe...	7.5 High	—	0,41%	30 Jul 2026
CVE-2026-12500 The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 o...	7.5 High	—	0,36%	30 Jul 2026
CVE-2026-11881 The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script whe...	6.1 Medium	—	0,25%	30 Jul 2026
CVE-2026-11870 The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllabl...	5.4 Medium	—	0,26%	30 Jul 2026
CVE-2026-11867 The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, a...	6.5 Medium	—	0,30%	30 Jul 2026
CVE-2026-11782 The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available t...	5.9 Medium	—	0,29%	30 Jul 2026
CVE-2026-67248 asustor data master A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated be...	8.8 High	—	0,49%	30 Jul 2026
CVE-2026-67247 asustor data master A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated...	6.5 Medium	—	0,45%	30 Jul 2026
CVE-2026-67246 asustor data master A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently vali...	6.5 Medium	—	0,46%	30 Jul 2026
CVE-2026-67245 asustor data master A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficiently valida...	8.1 High	—	0,33%	30 Jul 2026
CVE-2026-16610 The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html f...	9.8 Critical	—	1,1%	30 Jul 2026
CVE-2026-1360 The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_pro...	7.5 High	—	1,2%	30 Jul 2026
CVE-2026-14356 The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifyin...	8.8 High	—	0,49%	30 Jul 2026
CVE-2026-67244 asustor data master A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may b...	7.2 High	—	0,50%	30 Jul 2026
CVE-2026-48449 adobe campaign Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exp...	9.8 Critical	—	0,86%	30 Jul 2026
CVE-2026-48448 adobe campaign Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to discl...	8.6 High	—	0,56%	30 Jul 2026
CVE-2026-1982 The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the plugin trus...	5.3 Medium	—	0,33%	30 Jul 2026
CVE-2026-18188 asustor data master A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data may be pro...	8.1 High	—	0,46%	30 Jul 2026
CVE-2026-18187 asustor data master A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an error respons...	8.1 High	—	0,46%	30 Jul 2026
CVE-2026-18186 asustor data master A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written int...	8.1 High	—	0,46%	30 Jul 2026
CVE-2026-16092 The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta_key' Custom Field via 'Save and Duplicate' Action in all versions up t...	6.5 Medium	—	0,41%	30 Jul 2026
CVE-2026-16727 Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code with eleva...	7.3 High	—	0,12%	30 Jul 2026
CVE-2026-15929 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL Injection. This issue affects...	7.1 High	—	0,28%	30 Jul 2026
CVE-2026-59952 Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled o...	6.9 Medium	—	0,38%	30 Jul 2026
CVE-2026-18019 google chrome Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium s...	4.3 Medium	—	0,26%	30 Jul 2026
CVE-2026-18018 google chrome Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium...	4.0 Medium	—	0,12%	30 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.