Katalog CVE (hal. 881)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.702 (Critical 36.692 · High 106.576 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 3 Nov 2026, 06:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 44.001–44.050 dari 266.702 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-12987 The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registra...	7.5 High	—	0,45%	22 Jul 2026
CVE-2026-12968 The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files...	8.8 High	—	0,51%	22 Jul 2026
CVE-2026-15802 The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' fu...	8.1 High	—	0,82%	22 Jul 2026
CVE-2026-56844 A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the...	8.4 High	—	0,18%	22 Jul 2026
CVE-2026-16492 A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of th...	5.5 Medium	—	3,9%	22 Jul 2026
CVE-2026-16490 A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the...	6.3 Medium	—	0,33%	22 Jul 2026
CVE-2026-63263 elasticsearch Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a...	6.5 Medium	—	0,47%	22 Jul 2026
CVE-2026-63262 elastic kibana Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.	4.3 Medium	—	0,28%	22 Jul 2026
CVE-2026-16489 A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection...	5.3 Medium	—	1,1%	22 Jul 2026
CVE-2026-16488 A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the componen...	5.0 Medium	—	1,5%	22 Jul 2026
CVE-2026-63261 elastic kibana Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a s...	6.5 Medium	—	0,47%	21 Jul 2026
CVE-2026-63260 elastic kibana Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege acc...	6.5 Medium	—	0,47%	21 Jul 2026
CVE-2026-63259 elastic kibana Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query resul...	4.3 Medium	—	0,29%	21 Jul 2026
CVE-2026-63145 elastic kibana Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly C...	4.3 Medium	—	0,27%	21 Jul 2026
CVE-2026-63144 elasticsearch Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A...	6.5 Medium	—	0,42%	21 Jul 2026
CVE-2026-63143 elastic kibana Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can acce...	4.3 Medium	—	0,33%	21 Jul 2026
CVE-2026-63142 elastic kibana Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions...	5.0 Medium	—	0,29%	21 Jul 2026
CVE-2026-56820 netty Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspCl...	9.1 Critical	—	0,31%	21 Jul 2026
CVE-2026-56819 netty Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Fin...	7.5 High	—	0,67%	21 Jul 2026
CVE-2026-56817 netty Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Fin...	9.8 Critical	—	0,69%	21 Jul 2026
CVE-2026-16517 A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encrypt...	2.9 Low	—	0,11%	21 Jul 2026
CVE-2026-16486 A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the ar...	4.3 Medium	—	0,47%	21 Jul 2026
CVE-2026-16485 A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such...	4.3 Medium	—	0,47%	21 Jul 2026
CVE-2026-16424 google chrome Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sand...	9.6 Critical	—	0,35%	21 Jul 2026
CVE-2026-16423 google chrome Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap...	8.8 High	—	0,35%	21 Jul 2026
CVE-2026-16422 google chrome Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perfor...	7.5 High	—	0,19%	21 Jul 2026
CVE-2026-16421 google chrome Inappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML...	8.8 High	—	0,52%	21 Jul 2026
CVE-2026-16420 google chrome Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromiu...	8.8 High	—	0,57%	21 Jul 2026
CVE-2026-16419 google chrome Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted...	9.6 Critical	—	0,26%	21 Jul 2026
CVE-2026-16418 google chrome Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromi...	8.8 High	—	0,45%	21 Jul 2026
CVE-2026-16417 google chrome Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a craf...	3.1 Low	—	0,24%	21 Jul 2026
CVE-2026-16416 google chrome Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (C...	9.3 Critical	—	0,13%	21 Jul 2026
CVE-2026-16415 google chrome Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)...	5.4 Medium	—	0,26%	21 Jul 2026
CVE-2026-16414 google chrome Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via mal...	7.8 High	—	0,12%	21 Jul 2026
CVE-2026-16413 google chrome Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...	8.3 High	—	0,27%	21 Jul 2026
CVE-2026-8989 autel maxicharger single charger firmware Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with ph...	6.8 Medium	—	0,24%	21 Jul 2026
CVE-2026-8988 autel maxicharger single charger firmware Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader...	6.8 Medium	—	0,24%	21 Jul 2026
CVE-2026-8987 autel maxicharger single charger firmware Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated...	8.8 High	—	0,64%	21 Jul 2026
CVE-2026-8986 autel maxicharger single charger firmware Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP se...	9.8 Critical	—	3,3%	21 Jul 2026
CVE-2026-8985 autel maxicharger single charger firmware Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can...	9.8 Critical	—	7,1%	21 Jul 2026
CVE-2026-8984 autel maxicharger single charger firmware Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /tes...	9.8 Critical	—	0,91%	21 Jul 2026
CVE-2026-65319 Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sen...	7.5 High	—	0,51%	21 Jul 2026
CVE-2026-65318 Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to is...	8.6 High	—	0,55%	21 Jul 2026
CVE-2026-65317 Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote...	8.6 High	—	0,61%	21 Jul 2026
CVE-2026-65316 XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are no...	6.5 Medium	—	0,51%	21 Jul 2026
CVE-2026-65315 Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a...	7.5 High	—	0,81%	21 Jul 2026
CVE-2026-65314 Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting su...	4.3 Medium	—	0,39%	21 Jul 2026
CVE-2026-63141 elastic kibana Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature...	5.4 Medium	—	0,23%	21 Jul 2026
CVE-2026-62574 oracle jre, oracle jdk +2 lainnya Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that ar...	7.8 High	—	0,11%	21 Jul 2026
CVE-2026-62567 oracle human resources management system Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploit...	7.7 High	—	0,35%	21 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.