Katalog CVE (hal. 954)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.651–47.700 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2023-49899 An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel.	9.8 Critical	—	0,31%	16 Jul 2026
CVE-2026-22752 broadcom spring authorization server Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 throug...	9.6 Critical	—	0,48%	16 Jul 2026
CVE-2026-7543 The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and including, 2.7.1 due to insufficient in...	7.2 High	—	0,32%	16 Jul 2026
CVE-2026-6424 Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system	6.7 Medium	—	0,16%	16 Jul 2026
CVE-2026-6423 A local privilege escalation vulnerability in ESET Inspect Connector. The vulnerability was caused by improper authentication in an IPC channel.	8.5 High	—	0,17%	16 Jul 2026
CVE-2026-58078 Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an unauth...	8.7 High	—	0,40%	16 Jul 2026
CVE-2026-15727 The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in all versions up to, and including, 1.4.2 due to in...	4.9 Medium	—	0,60%	16 Jul 2026
CVE-2026-15651 The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' parameter in all versions up to, and including, 14.6 d...	4.9 Medium	—	0,48%	16 Jul 2026
CVE-2026-15610 The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5...	4.3 Medium	—	0,40%	16 Jul 2026
CVE-2026-15407 The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifyi...	4.3 Medium	—	0,47%	16 Jul 2026
CVE-2026-15350 The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due to the plugin not properly verif...	4.3 Medium	—	0,39%	16 Jul 2026
CVE-2026-15324 The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'row_type' param...	4.4 Medium	—	0,34%	16 Jul 2026
CVE-2026-15106 The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5...	5.3 Medium	—	0,47%	16 Jul 2026
CVE-2026-15103 The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in...	8.8 High	—	0,56%	16 Jul 2026
CVE-2026-15099 The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is...	6.4 Medium	—	0,33%	16 Jul 2026
CVE-2026-15022 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and i...	6.5 Medium	—	0,57%	16 Jul 2026
CVE-2026-15021 The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insuffi...	6.4 Medium	—	0,36%	16 Jul 2026
CVE-2026-15008 The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient...	8.1 High	—	1,0%	16 Jul 2026
CVE-2026-15005 The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce...	8.8 High	—	0,33%	16 Jul 2026
CVE-2026-13767 The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient e...	6.5 Medium	—	0,41%	16 Jul 2026
CVE-2026-13755 The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute in all versions up to...	6.4 Medium	—	0,39%	16 Jul 2026
CVE-2026-13754 The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 3.6.0.0...	6.5 Medium	—	0,41%	16 Jul 2026
CVE-2026-13741 The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due...	8.8 High	—	0,44%	16 Jul 2026
CVE-2026-15925 Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certifica...	9.2 Critical	—	0,18%	16 Jul 2026
CVE-2026-12979 The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with admi...	5.5 Medium	—	0,34%	16 Jul 2026
CVE-2026-12978 The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX acti...	7.1 High	—	0,28%	16 Jul 2026
CVE-2026-12907 The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to c...	2.7 Low	—	0,28%	16 Jul 2026
CVE-2026-12906 The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing...	2.7 Low	—	0,30%	16 Jul 2026
CVE-2026-12869 The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows an...	6.1 Medium	—	0,25%	16 Jul 2026
CVE-2026-12684 The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions...	6.5 Medium	—	0,43%	16 Jul 2026
CVE-2026-12585 The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, a...	8.1 High	—	0,38%	16 Jul 2026
CVE-2026-12525 The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least t...	8.8 High	—	0,42%	16 Jul 2026
CVE-2026-12510 The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with sub...	5.9 Medium	—	0,23%	16 Jul 2026
CVE-2026-12492 The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based...	9.8 Critical	—	0,50%	16 Jul 2026
CVE-2026-12395 The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a sub...	6.5 Medium	—	0,37%	16 Jul 2026
CVE-2026-11866 The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher,...	5.4 Medium	—	0,14%	16 Jul 2026
CVE-2026-11371 The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it...	6.1 Medium	—	0,28%	16 Jul 2026
CVE-2026-53366 linux kernel In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocat...	7.8 High	—	0,17%	16 Jul 2026
CVE-2026-15458 The SEO Booster plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_field' parameter in all versions up to, and including, 7.3.1 due to insufficient...	4.9 Medium	—	0,44%	16 Jul 2026
CVE-2026-15445 The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.3.1 due to insufficient...	4.9 Medium	—	0,44%	16 Jul 2026
CVE-2026-15306 The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter...	6.1 Medium	—	0,38%	16 Jul 2026
CVE-2026-15013 The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and includin...	9.8 Critical	—	2,4%	16 Jul 2026
CVE-2026-13042 The RPB Chessboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 8.1.2 due to insufficient i...	7.2 High	—	0,43%	16 Jul 2026
CVE-2026-21729 Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.	7.5 High	—	0,46%	16 Jul 2026
CVE-2026-15652 The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'align' Block Attribute in all v...	6.4 Medium	—	0,33%	16 Jul 2026
CVE-2026-15336 The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3. This is due to the catch_themes_demo_impor...	4.3 Medium	—	0,43%	16 Jul 2026
CVE-2026-14987 The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in...	6.4 Medium	—	0,36%	16 Jul 2026
CVE-2026-13005 The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and...	4.4 Medium	—	0,33%	16 Jul 2026
CVE-2026-12941 The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in al...	6.5 Medium	—	0,41%	16 Jul 2026
CVE-2026-12753 The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter in all versi...	7.5 High	—	0,51%	16 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.