Katalog CVE (hal. 949)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.401–47.450 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15094 The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 du...	6.1 Medium	—	0,69%	17 Jul 2026
CVE-2026-60060 Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to...	5.1 Medium	—	0,32%	17 Jul 2026
CVE-2026-58317 Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH...	5.1 Medium	—	0,32%	17 Jul 2026
CVE-2026-41993 Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileges to bypas...	4.4 Medium	—	0,15%	17 Jul 2026
CVE-2026-21770 HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with maliciou...	6.5 Medium	—	0,16%	17 Jul 2026
CVE-2026-15759 The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'gr...	6.4 Medium	—	0,35%	17 Jul 2026
CVE-2026-15457 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via...	4.9 Medium	—	1,1%	17 Jul 2026
CVE-2026-15349 The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6...	4.3 Medium	—	0,47%	17 Jul 2026
CVE-2026-15161 The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.6. This is due to the save_filter()...	6.4 Medium	—	0,26%	17 Jul 2026
CVE-2026-14503 The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pcl_ajax_process_request_...	6.5 Medium	—	0,51%	17 Jul 2026
CVE-2026-13765 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i...	7.5 High	—	0,68%	17 Jul 2026
CVE-2026-13352 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary...	8.8 High	—	1,1%	17 Jul 2026
CVE-2026-8616 The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on th...	5.3 Medium	—	0,39%	17 Jul 2026
CVE-2026-15395 The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions...	7.2 High	—	0,43%	17 Jul 2026
CVE-2026-15160 The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name'...	4.3 Medium	—	0,66%	17 Jul 2026
CVE-2026-15159 The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheet_exp...	4.3 Medium	—	0,28%	17 Jul 2026
CVE-2026-11324 The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter...	6.1 Medium	—	0,39%	17 Jul 2026
CVE-2026-62387 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, including auth...	7.1 High	—	0,31%	17 Jul 2026
CVE-2026-62386 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::e...	7.5 High	—	0,33%	17 Jul 2026
CVE-2026-62241 mohibshaikh clawvet clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.ex...	9.1 Critical	—	0,67%	17 Jul 2026
CVE-2026-62238 openremote OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenatin...	8.8 High	—	0,50%	17 Jul 2026
CVE-2026-62237 Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig conten...	6.5 Medium	—	0,30%	17 Jul 2026
CVE-2026-62236 grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists...	5.4 Medium	—	0,12%	17 Jul 2026
CVE-2026-62235 Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access perm...	6.3 Medium	—	0,29%	17 Jul 2026
CVE-2026-62234 Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, d...	8.1 High	—	0,37%	17 Jul 2026
CVE-2026-62233 grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to e...	8.8 High	—	0,44%	17 Jul 2026
CVE-2026-62232 Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authori...	7.4 High	—	0,35%	17 Jul 2026
CVE-2026-62231 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthent...	8.1 High	—	0,28%	17 Jul 2026
CVE-2026-62230 Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.)...	7.5 High	—	0,38%	17 Jul 2026
CVE-2026-62229 openclaw OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended...	8.8 High	—	0,72%	17 Jul 2026
CVE-2026-62228 openclaw OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended aut...	8.8 High	—	0,45%	17 Jul 2026
CVE-2026-62227 openclaw OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Att...	7.7 High	—	0,39%	17 Jul 2026
CVE-2026-62226 openclaw OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attacke...	8.5 High	—	0,33%	17 Jul 2026
CVE-2026-62225 openclaw OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions b...	5.4 Medium	—	0,25%	17 Jul 2026
CVE-2026-62224 OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust ac...	5.4 Medium	—	0,26%	17 Jul 2026
CVE-2026-62223 openclaw OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond thei...	8.8 High	—	0,45%	17 Jul 2026
CVE-2026-62222 openclaw OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or...	7.8 High	—	0,18%	17 Jul 2026
CVE-2026-62221 openclaw OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature. When the affected feature is enabled and reachab...	5.4 Medium	—	0,24%	17 Jul 2026
CVE-2026-62220 openclaw OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the a...	5.3 Medium	—	0,52%	17 Jul 2026
CVE-2026-62219 openclaw OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path c...	7.1 High	—	0,30%	17 Jul 2026
CVE-2026-62218 openclaw OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-manage...	8.8 High	—	0,45%	17 Jul 2026
CVE-2026-62217 openclaw OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust cal...	8.8 High	—	0,45%	17 Jul 2026
CVE-2026-62216 openclaw OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload...	5.0 Medium	—	0,29%	17 Jul 2026
CVE-2026-62215 openclaw OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. A...	8.0 High	—	0,25%	17 Jul 2026
CVE-2026-62214 openclaw OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials...	6.5 Medium	—	0,44%	17 Jul 2026
CVE-2026-62213 openclaw OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Att...	6.5 Medium	—	0,36%	17 Jul 2026
CVE-2026-62212 openclaw OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust calle...	7.1 High	—	0,23%	17 Jul 2026
CVE-2026-62211 openclaw OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that...	5.0 Medium	—	0,15%	17 Jul 2026
CVE-2026-62210 openclaw OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. A...	6.5 Medium	—	0,45%	17 Jul 2026
CVE-2026-62209 openclaw OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy...	8.1 High	—	0,37%	17 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.