Katalog CVE (hal. 88) — KUTIM-CSIRT

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.538 (Critical 35.913 · High 103.408 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 4.351–4.400 dari 258.538 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-108604 Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to...	6.3 Medium	—	0,13%	10 Okt 2026
CVE-2026-108603 slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via...	3.3 Low	—	0,14%	10 Okt 2026
CVE-2026-108602 Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach inter...	4.3 Medium	—	0,21%	10 Okt 2026
CVE-2026-107434 Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.	5.4 Medium	—	0,27%	10 Okt 2026
CVE-2026-107420 Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.	5.3 Medium	—	0,12%	10 Okt 2026
CVE-2026-103685 Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configur...	4.3 Medium	—	0,19%	10 Okt 2026
CVE-2026-96341 Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.	8.2 High	—	0,28%	10 Okt 2026
CVE-2026-94590 Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issu...	6.5 Medium	—	0,19%	10 Okt 2026
CVE-2026-57806 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury a...	7.1 High	—	0,18%	10 Okt 2026
CVE-2026-108600 open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create file...	4.7 Medium	—	0,15%	10 Okt 2026
CVE-2026-108599 phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only...	4.7 Medium	—	0,17%	10 Okt 2026
CVE-2026-108598 Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity...	9.8 Critical	—	0,73%	10 Okt 2026
CVE-2026-108597 Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated ta...	4.8 Medium	—	0,29%	10 Okt 2026
CVE-2026-108596 OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id...	5.3 Medium	—	0,30%	10 Okt 2026
CVE-2026-108595 Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unche...	5.3 Medium	—	0,26%	10 Okt 2026
CVE-2026-108594 Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity pro...	3.5 Low	—	0,19%	10 Okt 2026
CVE-2026-108593 9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard user...	6.4 Medium	—	0,27%	10 Okt 2026
CVE-2026-108592 mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit...	5.3 Medium	—	0,32%	10 Okt 2026
CVE-2026-108591 InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI...	4.4 Medium	—	0,27%	10 Okt 2026
CVE-2026-106610 Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects minioran...	9.8 Critical	—	0,48%	10 Okt 2026
CVE-2026-105892 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media...	9.8 Critical	—	0,42%	10 Okt 2026
CVE-2026-94160 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-e...	7.1 High	—	0,15%	10 Okt 2026
CVE-2026-62044 Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a...	7.2 High	—	0,30%	10 Okt 2026
CVE-2026-108586 1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement u...	5.4 Medium	—	0,19%	10 Okt 2026
CVE-2026-108585 argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpo...	5.4 Medium	—	0,29%	10 Okt 2026
CVE-2026-106609 Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af...	7.5 High	—	0,22%	10 Okt 2026
CVE-2026-106608 Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.	7.2 High	—	0,26%	10 Okt 2026
CVE-2026-105889 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Inje...	9.3 Critical	—	0,26%	10 Okt 2026
CVE-2026-104398 Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This iss...	9.8 Critical	—	0,34%	10 Okt 2026
CVE-2026-103357 Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This...	6.9 Medium	—	0,26%	10 Okt 2026
CVE-2026-103071 Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code...	7.5 High	—	0,25%	10 Okt 2026
CVE-2026-108583 zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fe...	4.2 Medium	—	0,18%	10 Okt 2026
CVE-2026-108582 GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and gen...	5.5 Medium	—	0,11%	10 Okt 2026
CVE-2026-108581 TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET...	6.5 Medium	—	0,24%	10 Okt 2026
CVE-2026-108580 AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated at...	6.5 Medium	—	0,26%	10 Okt 2026
CVE-2026-108579 OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile ID...	4.2 Medium	—	0,20%	10 Okt 2026
CVE-2026-108555 PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf...	4.2 Medium	—	0,14%	10 Okt 2026
CVE-2026-108554 PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URL...	5.3 Medium	—	0,23%	10 Okt 2026
CVE-2026-108553 OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. At...	7.5 High	—	0,19%	10 Okt 2026
CVE-2026-108551 openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying...	9.8 Critical	—	0,42%	10 Okt 2026
CVE-2026-108550 SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take ove...	8.8 High	—	0,30%	10 Okt 2026
CVE-2026-108549 cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated upda...	8.1 High	—	0,45%	10 Okt 2026
CVE-2026-108548 AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unau...	7.3 High	—	0,29%	10 Okt 2026
CVE-2026-108547 AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get...	6.5 Medium	—	0,24%	10 Okt 2026
CVE-2026-108546 Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots wi...	7.5 High	—	0,80%	10 Okt 2026
CVE-2026-108545 SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middle...	5.9 Medium	—	0,58%	10 Okt 2026
CVE-2026-108115 Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4...	4.9 Medium	—	0,19%	10 Okt 2026
CVE-2026-108114 Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's ro...	4.3 Medium	—	0,20%	10 Okt 2026
CVE-2026-97264 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue a...	7.1 High	—	0,15%	10 Okt 2026
CVE-2026-97263 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affe...	7.1 High	—	0,15%	10 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.