Katalog CVE (hal. 844)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.301 (Critical 36.664 · High 106.384 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 42.151–42.200 dari 266.301 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-14924 The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated...	7.5 High	—	0,44%	28 Jul 2026
CVE-2026-14870 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an...	7.1 High	—	0,47%	28 Jul 2026
CVE-2026-14821 The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-lev...	2.7 Low	—	0,28%	28 Jul 2026
CVE-2026-14819 The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users wit...	3.5 Low	—	0,24%	28 Jul 2026
CVE-2026-14545 The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing...	9.8 Critical	—	0,50%	28 Jul 2026
CVE-2026-14490 The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0....	7.5 High	—	0,76%	28 Jul 2026
CVE-2026-12124 The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data...	5.3 Medium	—	0,35%	28 Jul 2026
CVE-2026-17528 Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that i...	6.1 Medium	—	0,38%	28 Jul 2026
CVE-2026-17524 Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacke...	7.5 High	—	1,2%	28 Jul 2026
CVE-2026-66473 Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.	7.5 High	—	0,35%	27 Jul 2026
CVE-2026-65448 Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions.	6.5 Medium	—	0,22%	27 Jul 2026
CVE-2026-65447 Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.	7.1 High	—	0,25%	27 Jul 2026
CVE-2026-65446 Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.	7.1 High	—	0,25%	27 Jul 2026
CVE-2026-65445 Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.	6.5 Medium	—	0,33%	27 Jul 2026
CVE-2026-65443 Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.	7.1 High	—	0,25%	27 Jul 2026
CVE-2026-65442 Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.	7.2 High	—	0,58%	27 Jul 2026
CVE-2026-65441 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.	7.1 High	—	0,25%	27 Jul 2026
CVE-2026-65440 Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.	7.1 High	—	0,25%	27 Jul 2026
CVE-2026-65439 Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.	7.1 High	—	0,25%	27 Jul 2026
CVE-2026-65438 Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.	7.1 High	—	0,25%	27 Jul 2026
CVE-2026-65437 Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.	7.1 High	—	0,25%	27 Jul 2026
CVE-2026-61957 Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.	7.1 High	—	0,25%	27 Jul 2026
CVE-2026-61953 Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.	7.2 High	—	0,27%	27 Jul 2026
CVE-2026-51565 Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web script or HTML via the a...	6.1 Medium	—	0,40%	27 Jul 2026
CVE-2025-63913 An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching co...	7.5 High	—	0,46%	27 Jul 2026
CVE-2026-59240 The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`....	6.9 Medium	—	0,48%	27 Jul 2026
CVE-2026-55685 shopify react-router React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy l...	7.5 High	—	0,71%	27 Jul 2026
CVE-2026-53669 shopify react-router React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a f...	6.1 Medium	—	0,32%	27 Jul 2026
CVE-2026-53668 shopify react-router React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker...	6.9 Medium	—	0,34%	27 Jul 2026
CVE-2026-53667 shopify react-router React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources....	6.1 Medium	—	0,36%	27 Jul 2026
CVE-2026-53666 shopify react-router React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain as...	6.1 Medium	—	0,42%	27 Jul 2026
CVE-2026-51564 An issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request.	4.9 Medium	—	0,66%	27 Jul 2026
CVE-2026-51078 An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the file_manage_control.php component	7.5 High	—	0,54%	27 Jul 2026
CVE-2026-51077 SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component	7.5 High	—	0,53%	27 Jul 2026
CVE-2021-32088 quest kace systems management appliance An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack....	9.8 Critical	—	0,52%	27 Jul 2026
CVE-2021-32087 quest kace systems management appliance An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf,...	8.8 High	—	0,53%	27 Jul 2026
CVE-2021-32086 quest kace systems management appliance An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases....	9.8 Critical	—	0,33%	27 Jul 2026
CVE-2021-32085 quest kace systems management appliance An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a pass...	8.8 High	—	0,53%	27 Jul 2026
CVE-2021-32084 quest kace systems management appliance An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API end...	9.8 Critical	—	0,56%	27 Jul 2026
CVE-2026-66825 Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link,...	6.9 Medium	—	0,44%	27 Jul 2026
CVE-2026-66824 A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline J...	9.2 Critical	—	0,44%	27 Jul 2026
CVE-2026-64783 apple safari, apple ipados +4 lainnya A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watch...	8.8 High	—	0,43%	27 Jul 2026
CVE-2026-64776 apple macos The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to disclose ke...	5.5 Medium	—	0,17%	27 Jul 2026
CVE-2026-64775 apple ipados, apple iphone os +4 lainnya A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, mac...	9.8 Critical	—	0,67%	27 Jul 2026
CVE-2026-64774 apple ipados, apple iphone os +3 lainnya An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m...	9.8 Critical	—	0,80%	27 Jul 2026
CVE-2026-64772 apple ipados, apple iphone os +3 lainnya An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia...	9.8 Critical	—	0,78%	27 Jul 2026
CVE-2026-64771 apple ipados, apple iphone os +3 lainnya A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macO...	9.8 Critical	—	0,85%	27 Jul 2026
CVE-2026-64770 apple ipados, apple iphone os +3 lainnya An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 1...	9.8 Critical	—	0,80%	27 Jul 2026
CVE-2026-64769 apple ipados, apple iphone os +3 lainnya An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 1...	9.8 Critical	—	0,80%	27 Jul 2026
CVE-2026-64768 apple ipados, apple iphone os +3 lainnya An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 1...	8.1 High	—	0,57%	27 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.