Katalog CVE (hal. 872)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.527 (Critical 36.676 · High 106.475 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 3 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.551–43.600 dari 266.527 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-27418 Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.	5.3 Medium	—	0,29%	23 Jul 2026
CVE-2026-27403 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub...	6.5 Medium	—	0,22%	23 Jul 2026
CVE-2026-27399 Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.	5.3 Medium	—	0,29%	23 Jul 2026
CVE-2026-27392 Contributor Broken Access Control in uListing <= 2.2.0 versions.	4.3 Medium	—	0,25%	23 Jul 2026
CVE-2026-27391 Subscriber Broken Access Control in uListing <= 2.2.0 versions.	5.4 Medium	—	0,29%	23 Jul 2026
CVE-2026-27377 Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.	6.7 Medium	—	0,38%	23 Jul 2026
CVE-2026-27372 Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.	6.5 Medium	—	0,37%	23 Jul 2026
CVE-2026-27355 Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.	5.3 Medium	—	0,38%	23 Jul 2026
CVE-2026-27064 Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.	9.1 Critical	—	0,50%	23 Jul 2026
CVE-2026-25466 Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.	5.3 Medium	—	0,31%	23 Jul 2026
CVE-2026-25427 Subscriber Broken Access Control in eRoom <= 1.7.1 versions.	5.4 Medium	—	0,29%	23 Jul 2026
CVE-2026-25424 Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.	4.3 Medium	—	0,25%	23 Jul 2026
CVE-2026-25405 Contributor SQL Injection in eRoom <= 1.7.1 versions.	8.5 High	—	0,36%	23 Jul 2026
CVE-2026-24639 Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.	4.4 Medium	—	0,21%	23 Jul 2026
CVE-2026-24628 Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.	5.9 Medium	—	0,24%	23 Jul 2026
CVE-2026-24552 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injec...	8.5 High	—	0,36%	23 Jul 2026
CVE-2026-24537 Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.	4.3 Medium	—	0,14%	23 Jul 2026
CVE-2025-68081 Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.	5.9 Medium	—	0,24%	23 Jul 2026
CVE-2026-64611 A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an e...	7.5 High	—	0,63%	23 Jul 2026
CVE-2026-16745 A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can b...	8.8 High	—	0,47%	23 Jul 2026
CVE-2026-65758 Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthen...	8.2 High	—	0,31%	23 Jul 2026
CVE-2026-65757 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module dat...	8.1 High	—	0,19%	23 Jul 2026
CVE-2026-65756 Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.	6.1 Medium	—	0,25%	23 Jul 2026
CVE-2026-65755 Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain...	7.5 High	—	0,42%	23 Jul 2026
CVE-2026-65754 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory.	7.5 High	—	0,50%	23 Jul 2026
CVE-2026-65713 Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories.	6.5 Medium	—	0,33%	23 Jul 2026
CVE-2026-65712 Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing l...	6.2 Medium	—	0,19%	23 Jul 2026
CVE-2026-65431 Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe f...	9.8 Critical	—	0,61%	23 Jul 2026
CVE-2026-65430 Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulner...	7.5 High	—	0,42%	23 Jul 2026
CVE-2026-64876 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super Us...	8.8 High	—	0,20%	23 Jul 2026
CVE-2026-64875 Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-ru...	6.5 Medium	—	0,36%	23 Jul 2026
CVE-2026-64874 Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs.	9.8 Critical	—	0,52%	23 Jul 2026
CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services.	9.8 Critical	—	0,48%	23 Jul 2026
CVE-2026-64872 Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory.	6.5 Medium	—	0,33%	23 Jul 2026
CVE-2026-64871 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require...	5.4 Medium	—	0,13%	23 Jul 2026
CVE-2026-64799 Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request priv...	7.5 High	—	0,43%	23 Jul 2026
CVE-2026-16078 The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type...	6.5 Medium	—	0,91%	23 Jul 2026
CVE-2026-15906 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and i...	6.5 Medium	—	0,47%	23 Jul 2026
CVE-2026-15827 The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists an...	5.3 Medium	—	0,54%	23 Jul 2026
CVE-2026-15794 The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and includi...	6.4 Medium	—	0,33%	23 Jul 2026
CVE-2026-15786 The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions u...	4.4 Medium	—	0,55%	23 Jul 2026
CVE-2026-15761 The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and incl...	6.5 Medium	—	0,45%	23 Jul 2026
CVE-2026-15647 The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and including,...	4.4 Medium	—	0,31%	23 Jul 2026
CVE-2026-15646 The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.8.8 d...	6.4 Medium	—	0,33%	23 Jul 2026
CVE-2026-15448 The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, a...	6.5 Medium	—	0,41%	23 Jul 2026
CVE-2026-15404 The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input s...	6.4 Medium	—	0,33%	23 Jul 2026
CVE-2026-15394 The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet Meta in all...	6.4 Medium	—	0,33%	23 Jul 2026
CVE-2026-15348 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpd...	6.3 Medium	—	0,58%	23 Jul 2026
CVE-2026-15017 The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability chec...	8.8 High	—	0,70%	23 Jul 2026
CVE-2026-15015 The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plu...	9.8 Critical	—	2,6%	23 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.