Katalog CVE (hal. 871)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.527 (Critical 36.676 · High 106.475 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 3 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.501–43.550 dari 266.527 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-61949 Unauthenticated SQL Injection in Bookly <= 27.7 versions.	9.3 Critical	—	0,40%	23 Jul 2026
CVE-2026-61948 Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.	9.3 Critical	—	0,40%	23 Jul 2026
CVE-2026-61947 Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-61946 Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.	6.5 Medium	—	0,33%	23 Jul 2026
CVE-2026-61945 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitiv...	6.5 Medium	—	0,37%	23 Jul 2026
CVE-2026-61944 Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-61943 Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.	7.5 High	—	0,39%	23 Jul 2026
CVE-2026-59555 Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.	10.0 Critical	—	0,61%	23 Jul 2026
CVE-2026-59554 Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.	7.5 High	—	0,43%	23 Jul 2026
CVE-2026-59547 Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.	7.5 High	—	0,35%	23 Jul 2026
CVE-2026-59545 Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.	8.1 High	—	0,46%	23 Jul 2026
CVE-2026-59544 Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.	9.8 Critical	—	0,56%	23 Jul 2026
CVE-2026-59543 Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.	9.9 Critical	—	0,79%	23 Jul 2026
CVE-2026-59542 Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.	7.7 High	—	0,47%	23 Jul 2026
CVE-2026-59541 Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.	8.8 High	—	0,42%	23 Jul 2026
CVE-2026-59540 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.	9.8 Critical	—	0,48%	23 Jul 2026
CVE-2026-59526 Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.	9.3 Critical	—	0,40%	23 Jul 2026
CVE-2026-59525 Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.	9.3 Critical	—	0,40%	23 Jul 2026
CVE-2026-59524 Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.	6.5 Medium	—	0,42%	23 Jul 2026
CVE-2026-59522 Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.	6.5 Medium	—	0,34%	23 Jul 2026
CVE-2026-59517 Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-59514 Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.	9.3 Critical	—	0,40%	23 Jul 2026
CVE-2026-59513 Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.	6.5 Medium	—	0,22%	23 Jul 2026
CVE-2026-59512 Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57809 Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57808 Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.	6.5 Medium	—	0,30%	23 Jul 2026
CVE-2026-57785 Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.	8.8 High	—	0,20%	23 Jul 2026
CVE-2026-57784 Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.	9.6 Critical	—	0,20%	23 Jul 2026
CVE-2026-57769 Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57767 Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57735 Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57717 Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.	6.5 Medium	—	0,33%	23 Jul 2026
CVE-2026-57716 Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.	5.3 Medium	—	0,38%	23 Jul 2026
CVE-2026-57704 Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57703 Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.	6.3 Medium	—	0,26%	23 Jul 2026
CVE-2026-57701 Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57699 Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57696 Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.	7.1 High	—	0,41%	23 Jul 2026
CVE-2026-57626 Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0.	7.1 High	—	0,13%	23 Jul 2026
CVE-2026-57428 Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57427 Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57425 Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.	6.5 Medium	—	0,33%	23 Jul 2026
CVE-2026-57397 Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57384 Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.	6.5 Medium	—	0,22%	23 Jul 2026
CVE-2026-57374 Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57373 Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.	6.5 Medium	—	0,22%	23 Jul 2026
CVE-2026-57370 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.	7.1 High	—	0,25%	23 Jul 2026
CVE-2026-57367 Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.	7.1 High	—	0,34%	23 Jul 2026
CVE-2026-27423 Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.	4.3 Medium	—	0,25%	23 Jul 2026
CVE-2026-27422 Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player:...	5.3 Medium	—	0,29%	23 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.