Katalog CVE (hal. 838)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.261 (Critical 36.656 · High 106.368 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 41.851–41.900 dari 266.261 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-63232 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control...	9.9 Critical	—	0,53%	29 Jul 2026
CVE-2026-63231 A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpo...	8.1 High	—	0,45%	29 Jul 2026
CVE-2026-63230 A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally...	9.1 Critical	—	0,52%	29 Jul 2026
CVE-2026-63229 A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to rea...	9.1 Critical	—	0,52%	29 Jul 2026
CVE-2026-63228 An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail r...	2.6 Low	—	0,21%	29 Jul 2026
CVE-2026-63227 An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly...	9.9 Critical	—	0,59%	29 Jul 2026
CVE-2026-14300 The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-ver...	8.1 High	—	0,38%	29 Jul 2026
CVE-2026-14234 The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in...	7.1 High	—	0,14%	29 Jul 2026
CVE-2026-14224 The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the ac...	5.4 Medium	—	0,23%	29 Jul 2026
CVE-2026-13692 The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated atta...	5.3 Medium	—	0,30%	29 Jul 2026
CVE-2026-13690 The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows...	7.4 High	—	0,41%	29 Jul 2026
CVE-2026-13605 The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without es...	6.8 Medium	—	0,43%	29 Jul 2026
CVE-2026-13423 The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-s...	9.8 Critical	—	0,96%	29 Jul 2026
CVE-2026-11974 The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available...	8.6 High	—	0,73%	29 Jul 2026
CVE-2026-11351 The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrie...	5.3 Medium	—	0,35%	29 Jul 2026
CVE-2026-18072 The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in...	9.8 Critical	—	3,0%	29 Jul 2026
CVE-2026-5626 The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all versions u...	4.3 Medium	—	0,34%	29 Jul 2026
CVE-2026-15344 The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insu...	4.9 Medium	—	0,60%	29 Jul 2026
CVE-2026-12476 The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type valida...	7.2 High	—	1,2%	29 Jul 2026
CVE-2026-17166 The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all vers...	4.3 Medium	—	0,40%	29 Jul 2026
CVE-2026-17162 The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all...	6.4 Medium	—	0,33%	29 Jul 2026
CVE-2026-17161 The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in...	6.4 Medium	—	0,33%	29 Jul 2026
CVE-2026-15735 The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions up to, and including, 3...	6.4 Medium	—	0,33%	29 Jul 2026
CVE-2026-12939 The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the post_thumbnail (and newsletters_post_thumbnail) sho...	6.4 Medium	—	0,35%	29 Jul 2026
CVE-2026-12938 The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the [newsletters_post] shortcode in versions up to an...	6.4 Medium	—	0,35%	29 Jul 2026
CVE-2026-12144 The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the `save_requests_me...	8.8 High	—	0,52%	29 Jul 2026
CVE-2026-56822 netty Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the Ss...	7.4 High	—	0,17%	29 Jul 2026
CVE-2026-56821 netty Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of...	7.4 High	—	0,22%	29 Jul 2026
CVE-2026-66064 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned...	5.3 Medium	—	0,45%	28 Jul 2026
CVE-2026-66063 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName()...	6.5 Medium	—	0,34%	28 Jul 2026
CVE-2026-64863 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only met...	9.1 Critical	—	0,42%	28 Jul 2026
CVE-2026-62325 goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "...	9.1 Critical	—	0,43%	28 Jul 2026
CVE-2026-59921 netty Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP r...	6.5 Medium	—	0,47%	28 Jul 2026
CVE-2026-54719 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downlo...	7.5 High	—	0,35%	28 Jul 2026
CVE-2026-54659 Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used...	6.9 Medium	—	0,54%	28 Jul 2026
CVE-2026-54658 Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single q...	9.8 Critical	—	0,82%	28 Jul 2026
CVE-2026-54650 openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preser...	8.6 High	—	0,53%	28 Jul 2026
CVE-2026-54638 gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from...	7.5 High	—	0,63%	28 Jul 2026
CVE-2026-47219 find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable t...	7.5 High	—	0,46%	28 Jul 2026
CVE-2026-55415 koxudaxi datamodel-code-generator datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML,...	7.5 High	—	0,49%	28 Jul 2026
CVE-2026-55403 datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie...	3.7 Low	—	0,34%	28 Jul 2026
CVE-2026-55391 koxudaxi datamodel-code-generator datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML,...	7.5 High	—	0,31%	28 Jul 2026
CVE-2026-55390 datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlsche...	7.5 High	—	0,55%	28 Jul 2026
CVE-2026-55389 koxudaxi datamodel-code-generator datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML,...	7.5 High	—	0,55%	28 Jul 2026
CVE-2026-54691 datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url t...	8.2 High	—	0,26%	28 Jul 2026
CVE-2026-54690 koxudaxi datamodel-code-generator datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML,...	8.2 High	—	0,39%	28 Jul 2026
CVE-2026-54656 koxudaxi datamodel-code-generator datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML,...	7.8 High	—	0,25%	28 Jul 2026
CVE-2026-54655 datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parse...	7.8 High	—	0,21%	28 Jul 2026
CVE-2026-54654 datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python c...	7.8 High	—	0,21%	28 Jul 2026
CVE-2026-54653 koxudaxi datamodel-code-generator datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML,...	8.8 High	—	0,71%	28 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.