Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 29 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-65478
Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.
|
5.4 Medium | — | 0,23% | 23 Jul 2026 |
|
CVE-2026-65477
Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.
|
7.5 High | — | 0,43% | 23 Jul 2026 |
|
CVE-2026-65476
Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-65475
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS.
This issue affects...
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65474
Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
|
5.3 Medium | — | 0,33% | 23 Jul 2026 |
|
CVE-2026-65473
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65472
Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-65471
Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.
|
9.6 Critical | — | 0,20% | 23 Jul 2026 |
|
CVE-2026-65470
Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65469
Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-65468
Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-65467
Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.
|
4.9 Medium | — | 0,19% | 23 Jul 2026 |
|
CVE-2026-65466
Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.
|
4.9 Medium | — | 0,19% | 23 Jul 2026 |
|
CVE-2026-65465
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65464
Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
|
5.4 Medium | — | 0,14% | 23 Jul 2026 |
|
CVE-2026-65463
Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.
|
5.4 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-65462
Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.
|
7.6 High | — | 0,38% | 23 Jul 2026 |
|
CVE-2026-65461
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
|
9.1 Critical | — | 0,50% | 23 Jul 2026 |
|
CVE-2026-65460
Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.
|
4.3 Medium | — | 0,14% | 23 Jul 2026 |
|
CVE-2026-65458
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Dat...
|
4.3 Medium | — | 0,30% | 23 Jul 2026 |
|
CVE-2026-65457
Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.
|
4.3 Medium | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-65456
Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.
|
4.3 Medium | — | 0,27% | 23 Jul 2026 |
|
CVE-2026-65455
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
|
9.1 Critical | — | 0,50% | 23 Jul 2026 |
|
CVE-2026-65454
Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
|
8.5 High | — | 0,36% | 23 Jul 2026 |
|
CVE-2026-65453
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-65452
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
|
5.3 Medium | — | 0,31% | 23 Jul 2026 |
|
CVE-2026-65451
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
|
8.5 High | — | 0,36% | 23 Jul 2026 |
|
CVE-2026-65450
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
|
8.5 High | — | 0,36% | 23 Jul 2026 |
|
CVE-2026-65449
Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-64815
jetbrains intellij idea
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
|
9.8 Critical | — | 0,48% | 23 Jul 2026 |
|
CVE-2026-64814
jetbrains intellij idea
In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session
|
8.6 High | — | 0,39% | 23 Jul 2026 |
|
CVE-2026-64813
jetbrains intellij idea
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
|
10.0 Critical | — | 0,52% | 23 Jul 2026 |
|
CVE-2026-64812
jetbrains intellij idea
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
|
10.0 Critical | — | 0,48% | 23 Jul 2026 |
|
CVE-2026-64811
jetbrains intellij idea
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration
|
7.8 High | — | 0,19% | 23 Jul 2026 |
|
CVE-2026-64810
jetbrains intellij idea
In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking
|
6.1 Medium | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-64809
jetbrains phpstorm
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter
|
8.4 High | — | 0,19% | 23 Jul 2026 |
|
CVE-2026-64808
jetbrains phpstorm
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling
|
8.4 High | — | 0,19% | 23 Jul 2026 |
|
CVE-2026-64807
jetbrains webstorm
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration
|
7.8 High | — | 0,19% | 23 Jul 2026 |
|
CVE-2026-64806
jetbrains webstorm
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter
|
8.4 High | — | 0,19% | 23 Jul 2026 |
|
CVE-2026-64805
jetbrains webstorm
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling
|
8.4 High | — | 0,19% | 23 Jul 2026 |
|
CVE-2026-64804
jetbrains webstorm
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling
|
8.4 High | — | 0,19% | 23 Jul 2026 |
|
CVE-2026-64803
jetbrains goland
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK
|
7.8 High | — | 0,21% | 23 Jul 2026 |
|
CVE-2026-64802
jetbrains goland
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
|
7.8 High | — | 0,21% | 23 Jul 2026 |
|
CVE-2026-64800
jetbrains goland
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
|
5.7 Medium | — | 0,85% | 23 Jul 2026 |
|
CVE-2026-61981
Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.
|
5.4 Medium | — | 0,14% | 23 Jul 2026 |
|
CVE-2026-61973
Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
|
4.3 Medium | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-61972
Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-61954
Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.
|
7.5 High | — | 0,35% | 23 Jul 2026 |
|
CVE-2026-61951
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.
|
9.8 Critical | — | 0,48% | 23 Jul 2026 |
|
CVE-2026-61950
Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
|
9.3 Critical | — | 0,40% | 23 Jul 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.