Katalog CVE (hal. 948)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.351–47.400 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-9592 SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token i...	7.5 High	—	0,24%	17 Jul 2026
CVE-2026-7488 Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce...	7.5 High	—	0,42%	17 Jul 2026
CVE-2026-51080 proxmox libpve-storage-perl libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.	9.8 Critical	—	0,52%	17 Jul 2026
CVE-2026-16072 redhat build of keycloak A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a no...	4.9 Medium	—	0,43%	17 Jul 2026
CVE-2026-16016 A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipulation of the...	7.3 High	—	0,50%	17 Jul 2026
CVE-2026-16015 A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of t...	6.3 Medium	—	0,58%	17 Jul 2026
CVE-2025-60357 ahnlab epp management AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.	8.1 High	—	0,42%	17 Jul 2026
CVE-2024-42214 HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are supported...	5.3 Medium	—	0,33%	17 Jul 2026
CVE-2024-23578 HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from an...	4.2 Medium	—	0,20%	17 Jul 2026
CVE-2024-23577 HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an ap...	4.3 Medium	—	0,30%	17 Jul 2026
CVE-2024-23575 HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An attacker ma...	5.3 Medium	—	0,33%	17 Jul 2026
CVE-2024-23574 HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system....	5.3 Medium	—	0,33%	17 Jul 2026
CVE-2024-23573 HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and DTLS1.0 or...	3.7 Low	—	0,24%	17 Jul 2026
CVE-2024-23572 HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the co...	4.2 Medium	—	0,13%	17 Jul 2026
CVE-2024-23571 HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields...	4.3 Medium	—	0,30%	17 Jul 2026
CVE-2024-23570 HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame o...	4.3 Medium	—	0,28%	17 Jul 2026
CVE-2024-23569 HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header	4.3 Medium	—	0,30%	17 Jul 2026
CVE-2024-23568 HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version information of so...	5.3 Medium	—	0,40%	17 Jul 2026
CVE-2024-23567 HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Da...	4.3 Medium	—	0,31%	17 Jul 2026
CVE-2024-23566 HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute force , aut...	6.5 Medium	—	0,27%	17 Jul 2026
CVE-2024-23565 HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could...	5.3 Medium	—	0,40%	17 Jul 2026
CVE-2024-23564 HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to...	9.1 Critical	—	0,30%	17 Jul 2026
CVE-2026-8396 Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: fr...	7.5 High	—	0,44%	17 Jul 2026
CVE-2026-7189 Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs....	7.5 High	—	0,42%	17 Jul 2026
CVE-2026-16014 A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the...	7.3 High	—	0,43%	17 Jul 2026
CVE-2026-13410 Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled...	8.2 High	—	0,38%	17 Jul 2026
CVE-2026-13082 GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters f...	5.3 Medium	—	0,31%	17 Jul 2026
CVE-2026-16013 A vulnerability has been found in liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760. Affected by this issue is the function CipAppPath::deserialize_symbol...	5.3 Medium	—	0,74%	17 Jul 2026
CVE-2026-16009 A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /prescriptionorderdetail.php. The manipulation of...	6.3 Medium	—	0,33%	17 Jul 2026
CVE-2026-15943 redhat build of keycloak A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates...	5.5 Medium	—	0,34%	17 Jul 2026
CVE-2026-9602 mattermost desktop Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner t...	6.5 Medium	—	0,42%	17 Jul 2026
CVE-2026-8075 mattermost desktop Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user to crash an...	6.5 Medium	—	0,42%	17 Jul 2026
CVE-2026-59695 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an a...	8.3 High	—	0,52%	17 Jul 2026
CVE-2026-59694 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per payment by a large multi...	8.3 High	—	0,52%	17 Jul 2026
CVE-2026-59252 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service fo...	8.2 High	—	0,46%	17 Jul 2026
CVE-2026-16008 A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/keywords/prope...	6.3 Medium	—	0,32%	17 Jul 2026
CVE-2026-22104 Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of...	7.1 High	—	0,45%	17 Jul 2026
CVE-2026-62764 apache accumulo Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote com...	6.5 Medium	—	0,79%	17 Jul 2026
CVE-2026-9656 The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11....	4.3 Medium	—	0,26%	17 Jul 2026
CVE-2026-15380 A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required (I...	5.1 Medium	—	0,17%	17 Jul 2026
CVE-2026-15379 The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypa...	5.1 Medium	—	0,15%	17 Jul 2026
CVE-2026-9810 The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing una...	9.8 Critical	—	0,50%	17 Jul 2026
CVE-2026-13402 The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints...	5.3 Medium	—	0,35%	17 Jul 2026
CVE-2026-12393 The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any aut...	5.4 Medium	—	0,29%	17 Jul 2026
CVE-2026-11966 The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions...	5.3 Medium	—	0,30%	17 Jul 2026
CVE-2026-11961 The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allo...	8.1 High	—	0,38%	17 Jul 2026
CVE-2026-11575 The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callb...	7.5 High	—	0,36%	17 Jul 2026
CVE-2026-10525 The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leadin...	6.1 Medium	—	0,51%	17 Jul 2026
CVE-2019-25764 UNSUPPORTED WHEN ASSIGNED Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and inv...	7.3 High	—	0,12%	17 Jul 2026
CVE-2026-15982 The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and...	9.8 Critical	—	0,53%	17 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.