Katalog CVE (hal. 92) — KUTIM-CSIRT

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.538 (Critical 35.913 · High 103.408 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 4.551–4.600 dari 258.538 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-96743 The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1...	6.4 Medium	—	0,19%	10 Okt 2026
CVE-2026-94589 The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, an...	9.8 Critical	—	0,66%	10 Okt 2026
CVE-2026-108501 ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively in...	5.7 Medium	—	0,16%	10 Okt 2026
CVE-2026-107645 The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration()...	9.1 Critical	—	0,29%	10 Okt 2026
CVE-2026-104898 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including,...	6.8 Medium	—	0,25%	10 Okt 2026
CVE-2026-104797 The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up t...	8.1 High	—	0,41%	10 Okt 2026
CVE-2026-104732 The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle...	9.8 Critical	—	0,47%	10 Okt 2026
CVE-2026-103365 The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4...	5.3 Medium	—	0,28%	10 Okt 2026
CVE-2026-101947 ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected me...	8.4 High	—	0,14%	10 Okt 2026
CVE-2026-93883 The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter in all versions up to, and including,...	6.4 Medium	—	0,20%	10 Okt 2026
CVE-2026-104915 The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4....	6.5 Medium	—	0,23%	10 Okt 2026
CVE-2026-104022 The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4....	5.4 Medium	—	0,13%	10 Okt 2026
CVE-2026-108474 In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions	9.8 Critical	—	0,32%	10 Okt 2026
CVE-2026-22061 Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrase...	8.2 High	—	0,11%	9 Okt 2026
CVE-2026-108269 Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accept...	9.1 Critical	—	0,13%	9 Okt 2026
CVE-2026-108268 Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS...	9.1 Critical	—	0,13%	9 Okt 2026
CVE-2026-108267 Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certifica...	9.1 Critical	—	0,12%	9 Okt 2026
CVE-2026-92705 Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `...	7.8 High	—	0,13%	9 Okt 2026
CVE-2026-62376 Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user...	8.1 High	—	0,22%	9 Okt 2026
CVE-2026-62367 Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on...	7.5 High	—	0,09%	9 Okt 2026
CVE-2026-57458 Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oa...	8.1 High	—	0,27%	9 Okt 2026
CVE-2026-108266 Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS c...	9.1 Critical	—	0,12%	9 Okt 2026
CVE-2026-108265 Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate pat...	9.1 Critical	—	0,12%	9 Okt 2026
CVE-2026-108264 Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through th...	9.1 Critical	—	0,38%	9 Okt 2026
CVE-2026-108263 Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/ru...	9.9 Critical	—	0,43%	9 Okt 2026
CVE-2026-108261 Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can tu...	9.3 Critical	—	0,16%	9 Okt 2026
CVE-2026-108260 Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node....	7.6 High	—	0,21%	9 Okt 2026
CVE-2026-108259 Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the ra...	8.2 High	—	0,25%	9 Okt 2026
CVE-2026-108258 Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins...	6.9 Medium	—	0,36%	9 Okt 2026
CVE-2026-107857 Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV p...	4.4 Medium	—	0,09%	9 Okt 2026
CVE-2026-107856 CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editC...	4.5 Medium	—	0,23%	9 Okt 2026
CVE-2026-107854 Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlle...	5.4 Medium	—	0,21%	9 Okt 2026
CVE-2026-107852 Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe...	7.1 High	—	0,16%	9 Okt 2026
CVE-2026-107851 Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php...	4.3 Medium	—	0,19%	9 Okt 2026
CVE-2026-107850 Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\Dat...	4.3 Medium	—	0,19%	9 Okt 2026
CVE-2026-107848 Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET g...	3.5 Low	—	0,11%	9 Okt 2026
CVE-2026-78797 An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.	9.8 Critical	—	0,62%	9 Okt 2026
CVE-2026-107845 Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered with...	9.3 Critical	—	0,27%	9 Okt 2026
CVE-2026-107844 Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target direc...	5.3 Medium	—	0,31%	9 Okt 2026
CVE-2026-107843 Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page con...	5.3 Medium	—	0,26%	9 Okt 2026
CVE-2026-107842 Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthent...	5.3 Medium	—	0,26%	9 Okt 2026
CVE-2026-78835 Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.	9.8 Critical	—	0,28%	9 Okt 2026
CVE-2026-75352 OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a deni...	7.5 High	—	0,33%	9 Okt 2026
CVE-2026-75351 OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a den...	7.5 High	—	0,40%	9 Okt 2026
CVE-2026-75350 EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This...	7.5 High	—	0,48%	9 Okt 2026
CVE-2026-108096 Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated re...	6.5 Medium	—	0,30%	9 Okt 2026
CVE-2026-107841 pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gat...	5.7 Medium	—	0,23%	9 Okt 2026
CVE-2026-107840 yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attack...	7.5 High	—	0,44%	9 Okt 2026
CVE-2026-107839 ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the...	7.5 High	—	0,34%	9 Okt 2026
CVE-2026-107838 RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07,...	7.5 High	—	0,34%	9 Okt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.