Katalog CVE (hal. 873)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.527 (Critical 36.676 · High 106.475 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 3 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 43.601–43.650 dari 266.527 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15011 The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 du...	9.8 Critical	—	0,95%	23 Jul 2026
CVE-2026-14481 The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' pa...	6.4 Medium	—	0,42%	23 Jul 2026
CVE-2026-14282 The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads...	9.8 Critical	—	1,3%	23 Jul 2026
CVE-2026-13119 The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_records_edit A...	6.5 Medium	—	0,41%	23 Jul 2026
CVE-2026-13009 The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 1.5.4 d...	6.5 Medium	—	0,45%	23 Jul 2026
CVE-2026-52688 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation	7.5 High	—	0,18%	23 Jul 2026
CVE-2026-52686 The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME...	3.7 Low	—	0,16%	23 Jul 2026
CVE-2026-52684 If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then...	3.7 Low	—	0,23%	23 Jul 2026
CVE-2026-16723 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no...	9.0 Critical	—	0,66%	23 Jul 2026
CVE-2026-16287 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus...	7.8 High	—	0,84%	23 Jul 2026
CVE-2024-58330 A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data.	7.5 High	—	0,50%	23 Jul 2026
CVE-2024-58023 Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information.	8.4 High	—	0,11%	23 Jul 2026
CVE-2026-9729 The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr_notification_title' and 'webpushr_notification_body' p...	6.4 Medium	—	0,33%	23 Jul 2026
CVE-2026-9713 The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file process...	7.5 High	—	0,46%	23 Jul 2026
CVE-2026-9635 The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and...	6.4 Medium	—	0,32%	23 Jul 2026
CVE-2026-59678 An Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any users to mount and unmount arbitrary file systems and modify the network configuration vi...	7.1 High	—	0,16%	23 Jul 2026
CVE-2026-59677 A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running...	6.8 Medium	—	0,14%	23 Jul 2026
CVE-2026-12421 The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient...	7.2 High	—	0,32%	23 Jul 2026
CVE-2026-9577 The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.ph...	4.8 Medium	—	0,24%	23 Jul 2026
CVE-2026-9066 The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of Ja...	6.1 Medium	—	0,25%	23 Jul 2026
CVE-2026-59676 A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfine...	5.8 Medium	—	0,10%	23 Jul 2026
CVE-2026-14291 The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an...	7.5 High	—	0,53%	23 Jul 2026
CVE-2026-12082 The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the per...	7.5 High	—	0,41%	23 Jul 2026
CVE-2026-7534 The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in version...	7.2 High	—	0,32%	23 Jul 2026
CVE-2026-7232 The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to i...	7.2 High	—	0,35%	23 Jul 2026
CVE-2026-64600 linux kernel In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are bot...	7.8 High	—	0,47%	23 Jul 2026
CVE-2026-63226 Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinat...	6.9 Medium	—	0,38%	23 Jul 2026
CVE-2026-6390 A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted...	6.8 Medium	—	0,15%	23 Jul 2026
CVE-2026-7120 fastify-static @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to...	5.3 Medium	—	0,37%	23 Jul 2026
CVE-2026-15074 fastify-static @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the ea...	7.5 High	—	0,67%	23 Jul 2026
CVE-2026-21723 The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in...	5.3 Medium	—	0,22%	23 Jul 2026
CVE-2026-16653 A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public...	5.3 Medium	—	0,69%	23 Jul 2026
CVE-2026-16632 A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of...	7.3 High	—	0,52%	23 Jul 2026
CVE-2026-16631 A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager Command Ha...	5.3 Medium	—	1,1%	23 Jul 2026
CVE-2026-61246 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.8 High	—	0,47%	22 Jul 2026
CVE-2026-60455 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.8 High	—	0,43%	22 Jul 2026
CVE-2026-60439 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.8 High	—	0,47%	22 Jul 2026
CVE-2026-60373 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.8 High	—	0,47%	22 Jul 2026
CVE-2026-60372 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	9.8 Critical	—	0,55%	22 Jul 2026
CVE-2026-60371 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.0 High	—	0,27%	22 Jul 2026
CVE-2026-60370 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	7.5 High	—	0,33%	22 Jul 2026
CVE-2026-60369 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	9.9 Critical	—	0,47%	22 Jul 2026
CVE-2026-60368 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	8.8 High	—	0,55%	22 Jul 2026
CVE-2026-60367 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	9.8 Critical	—	0,55%	22 Jul 2026
CVE-2026-60366 oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected...	10.0 Critical	—	0,55%	22 Jul 2026
CVE-2026-38766 An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_186f4 function	7.8 High	—	0,14%	22 Jul 2026
CVE-2026-38765 An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys	7.8 High	—	0,14%	22 Jul 2026
CVE-2026-38763 An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a denial of service via the function sub_13828	5.5 Medium	—	0,14%	22 Jul 2026
CVE-2026-16630 A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file package.json. T...	5.3 Medium	—	1,1%	22 Jul 2026
CVE-2026-16629 A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of...	5.3 Medium	—	1,1%	22 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.