Katalog CVE (hal. 986)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 49.251–49.300 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15557 A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requir...	7.3 High	—	0,69%	13 Jul 2026
CVE-2026-15548 A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the compone...	8.8 High	—	0,79%	13 Jul 2026
CVE-2026-14846 In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in t...	4.5 Medium	—	0,43%	13 Jul 2026
CVE-2026-13014 A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable...	9.2 Critical	—	0,70%	13 Jul 2026
CVE-2026-9708 mattermost server Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or chann...	4.9 Medium	—	0,36%	13 Jul 2026
CVE-2026-9597 mattermost server Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path,...	5.4 Medium	—	0,23%	13 Jul 2026
CVE-2026-9571 mattermost server Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactiv...	6.5 Medium	—	0,30%	13 Jul 2026
CVE-2026-6850 mattermost server Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an au...	6.5 Medium	—	0,42%	13 Jul 2026
CVE-2026-62143 A Server-Side Request Forgery (SSRF) protection bypass existed in the html_to_markdown expansion module of misp-modules. The module attempts to prevent requests to loopb...	8.3 High	—	0,41%	13 Jul 2026
CVE-2026-15574 A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, which may cont...	7.5 High	—	0,52%	13 Jul 2026
CVE-2026-15547 A weakness has been identified in Shibby Tomato up to 1.28.0000. This affects the function sub_2D048 of the component CIFS Mount Handler. Executing a manipulation of the...	6.3 Medium	—	1,8%	13 Jul 2026
CVE-2026-15546 A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing a manipula...	6.3 Medium	—	1,8%	13 Jul 2026
CVE-2026-15545 A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affected by this vulnerability is the function main of the file www/apcupsd/tomatodata.cgi of the compone...	8.8 High	—	0,73%	13 Jul 2026
CVE-2026-14453 This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm...	9.6 Critical	—	0,84%	13 Jul 2026
CVE-2026-10106 mattermost server Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the targ...	6.5 Medium	—	0,30%	13 Jul 2026
CVE-2026-10103 mattermost server Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an auth...	4.3 Medium	—	0,24%	13 Jul 2026
CVE-2026-10085 mattermost server Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that suppor...	5.4 Medium	—	0,29%	13 Jul 2026
CVE-2026-57830 ollyo helix ultimate Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenti...	9.1 Critical	—	0,50%	13 Jul 2026
CVE-2026-57829 ollyo helix ultimate Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored...	6.1 Medium	—	0,25%	13 Jul 2026
CVE-2026-4769 Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally doc...	9.8 Critical	—	0,76%	13 Jul 2026
CVE-2026-15544 A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the function getupsvar of the file www/apcupsd/tomatodata.cgi of the component apcupsd. This...	8.8 High	—	0,79%	13 Jul 2026
CVE-2026-15543 A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formCertListInfo of the file /goform/CertListInfo. The manipulation of the argument Name result...	8.8 High	—	0,85%	13 Jul 2026
CVE-2026-15542 A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentica...	7.3 High	—	0,70%	13 Jul 2026
CVE-2026-15541 A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master...	7.3 High	—	0,54%	13 Jul 2026
CVE-2026-15540 A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Adm...	4.3 Medium	—	0,42%	13 Jul 2026
CVE-2026-14165 An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of oth...	7.5 High	—	0,42%	13 Jul 2026
CVE-2026-15539 A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the...	4.7 Medium	—	0,40%	13 Jul 2026
CVE-2026-15538 A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectU...	6.3 Medium	—	0,54%	13 Jul 2026
CVE-2026-15537 A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation...	7.3 High	—	0,43%	13 Jul 2026
CVE-2026-15536 A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulation of the...	6.3 Medium	—	0,33%	13 Jul 2026
CVE-2026-12582 The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenti...	8.6 High	—	0,45%	13 Jul 2026
CVE-2026-12397 The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a...	4.3 Medium	—	0,27%	13 Jul 2026
CVE-2026-12396 The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with...	5.4 Medium	—	0,29%	13 Jul 2026
CVE-2026-12275 The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability c...	7.1 High	—	0,29%	13 Jul 2026
CVE-2026-12274 The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builde...	6.5 Medium	—	0,30%	13 Jul 2026
CVE-2026-12273 The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores th...	4.3 Medium	—	0,28%	13 Jul 2026
CVE-2026-12271 The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-le...	5.4 Medium	—	0,29%	13 Jul 2026
CVE-2026-12081 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied...	5.0 Medium	—	0,23%	13 Jul 2026
CVE-2026-11964 The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on the...	9.1 Critical	—	0,45%	13 Jul 2026
CVE-2026-11963 The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify fr...	8.1 High	—	0,35%	13 Jul 2026
CVE-2026-10551 The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HT...	6.1 Medium	—	0,25%	13 Jul 2026
CVE-2026-15535 A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize_from of th...	6.3 Medium	—	0,43%	13 Jul 2026
CVE-2026-15533 A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Performing a mani...	4.7 Medium	—	0,43%	13 Jul 2026
CVE-2026-15532 A vulnerability was identified in SourceCodester Online Book Store System 1.0. This issue affects some unknown processing of the component User Management Module. Such ma...	2.4 Low	—	0,37%	13 Jul 2026
CVE-2026-15531 A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.load of the fi...	5.3 Medium	—	0,32%	13 Jul 2026
CVE-2026-15530 A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=upload of the...	5.3 Medium	—	0,53%	13 Jul 2026
CVE-2026-9492 The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticat...	7.8 High	—	0,16%	13 Jul 2026
CVE-2026-7162 Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected software.	7.8 High	—	0,14%	13 Jul 2026
CVE-2026-15553 Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload malicious files and make them...	5.3 Medium	—	0,41%	13 Jul 2026
CVE-2026-15552 Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent JavaScript co...	6.1 Medium	—	0,34%	13 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.