Katalog CVE (hal. 916)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.988 (Critical 36.707 · High 106.683 · KEV 1.766 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 45.751–45.800 dari 266.988 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15812 A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version affected: <= 1.34). When the framework is explicitly configured to man...	4.8 Medium	—	0,26%	21 Jul 2026
CVE-2026-15811 A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segme...	5.8 Medium	—	0,08%	21 Jul 2026
CVE-2026-15782 The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via...	4.9 Medium	—	0,29%	21 Jul 2026
CVE-2026-13439 The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11...	9.8 Critical	—	0,71%	21 Jul 2026
CVE-2023-37507 hcltech devops plan HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed.	7.5 High	—	0,42%	21 Jul 2026
CVE-2026-15156 The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global C...	6.4 Medium	—	0,35%	21 Jul 2026
CVE-2023-37508 hcltech devops plan HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknesses are pre...	6.1 Medium	—	0,22%	21 Jul 2026
CVE-2026-59776 Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in t...	7.0 High	—	0,17%	21 Jul 2026
CVE-2026-16336 A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the comp...	4.3 Medium	—	0,45%	21 Jul 2026
CVE-2026-6952 A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.2)C0 could...	7.2 High	—	1,5%	21 Jul 2026
CVE-2026-63729 The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that al...	6.6 Medium	—	0,18%	21 Jul 2026
CVE-2026-16334 A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulati...	6.3 Medium	—	0,33%	21 Jul 2026
CVE-2026-16332 A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument...	7.3 High	—	1,4%	21 Jul 2026
CVE-2026-16331 A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation of the arg...	7.3 High	—	1,6%	21 Jul 2026
CVE-2026-16330 A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of t...	7.3 High	—	1,6%	21 Jul 2026
CVE-2026-16329 A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the argument Mali...	7.3 High	—	1,4%	21 Jul 2026
CVE-2026-63728 Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment vari...	6.3 Medium	—	0,21%	21 Jul 2026
CVE-2026-55833 netty Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues in...	7.5 High	—	0,67%	21 Jul 2026
CVE-2026-55831 netty Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a...	7.5 High	—	0,67%	21 Jul 2026
CVE-2026-16327 A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the a...	7.3 High	—	1,6%	21 Jul 2026
CVE-2026-15905 google chrome Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium security s...	7.8 High	—	0,14%	20 Jul 2026
CVE-2026-15904 google chrome Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially...	8.8 High	—	0,35%	20 Jul 2026
CVE-2026-15903 google chrome Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page....	8.8 High	—	0,41%	20 Jul 2026
CVE-2026-15902 google chrome Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium se...	8.8 High	—	0,41%	20 Jul 2026
CVE-2026-15901 google chrome Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium sec...	9.6 Critical	—	0,35%	20 Jul 2026
CVE-2026-15900 google chrome Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro...	9.6 Critical	—	0,35%	20 Jul 2026
CVE-2026-15899 google chrome Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page....	9.6 Critical	—	0,35%	20 Jul 2026
CVE-2026-64626 AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retr...	6.4 Medium	—	0,23%	20 Jul 2026
CVE-2026-64625 AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $()...	9.8 Critical	—	0,60%	20 Jul 2026
CVE-2026-64624 freerdp FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attac...	7.8 High	—	0,18%	20 Jul 2026
CVE-2026-57852 Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exp...	5.6 Medium	—	0,69%	20 Jul 2026
CVE-2026-57495 AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agent...	8.2 High	—	0,36%	20 Jul 2026
CVE-2026-57494 AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enum...	7.1 High	—	0,27%	20 Jul 2026
CVE-2026-55550 NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions...	7.1 High	—	0,23%	20 Jul 2026
CVE-2026-55544 NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the netwo...	7.6 High	—	0,22%	20 Jul 2026
CVE-2026-52656 An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FE...	9.8 Critical	—	0,73%	20 Jul 2026
CVE-2026-51385 An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, safe_fetch, _build_opener, _f...	6.9 Medium	—	0,53%	20 Jul 2026
CVE-2026-51031 FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive i...	7.5 High	—	0,49%	20 Jul 2026
CVE-2026-51025 Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file	6.1 Medium	—	0,25%	20 Jul 2026
CVE-2026-47255 AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness re...	8.2 High	—	0,25%	20 Jul 2026
CVE-2026-47144 Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.ya...	5.5 Medium	—	0,18%	20 Jul 2026
CVE-2026-47134 ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (`/Lib...	6.9 Medium	—	0,15%	20 Jul 2026
CVE-2026-47133 ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy stor...	6.9 Medium	—	0,15%	20 Jul 2026
CVE-2026-47128 nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix doma...	6.1 Medium	—	0,13%	20 Jul 2026
CVE-2026-16324 A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp. Such mani...	7.3 High	—	0,47%	20 Jul 2026
CVE-2026-12900 The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `uagb/image` block in all ve...	6.4 Medium	—	0,32%	20 Jul 2026
CVE-2024-51316 The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName	7.5 High	—	0,42%	20 Jul 2026
CVE-2024-51315 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevName	9.8 Critical	—	0,51%	20 Jul 2026
CVE-2024-51314 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg.	9.8 Critical	—	0,51%	20 Jul 2026
CVE-2024-51312 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/SetStaticRouteCfg.	9.8 Critical	—	0,51%	20 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.