Katalog CVE (hal. 990)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 49.451–49.500 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15072 The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and...	6.5 Medium	—	0,47%	11 Jul 2026
CVE-2026-13353 The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and inclu...	8.8 High	—	1,1%	11 Jul 2026
CVE-2026-13262 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter in all ver...	6.5 Medium	—	0,59%	11 Jul 2026
CVE-2026-13114 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info...	7.2 High	—	0,43%	11 Jul 2026
CVE-2026-12426 The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via t...	5.3 Medium	—	0,48%	11 Jul 2026
CVE-2026-10628 The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin...	4.3 Medium	—	0,58%	11 Jul 2026
CVE-2026-13756 The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta...	8.8 High	—	0,44%	11 Jul 2026
CVE-2026-11426 The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin accepting ar...	6.5 Medium	—	0,46%	11 Jul 2026
CVE-2026-55175 linuxfoundation spinnaker Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kus...	7.5 High	—	1,1%	10 Jul 2026
CVE-2026-44383 Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients...	7.5 High	—	0,56%	10 Jul 2026
CVE-2026-42952 Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service at...	7.5 High	—	0,54%	10 Jul 2026
CVE-2026-20744 The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.	9.8 Critical	—	0,76%	10 Jul 2026
CVE-2026-15089 Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: ..	9.1 Critical	—	0,40%	10 Jul 2026
CVE-2026-15087 vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: ..	5.9 Medium	—	0,31%	10 Jul 2026
CVE-2026-15086 vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: ..	5.9 Medium	—	0,33%	10 Jul 2026
CVE-2026-14480 OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplie...	9.9 Critical	—	0,62%	10 Jul 2026
CVE-2026-11915 vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: ..	5.9 Medium	—	0,31%	10 Jul 2026
CVE-2026-11914 vulnerability in Drupal Composer allows . This issue affects Composer versions: ..	5.9 Medium	—	0,35%	10 Jul 2026
CVE-2026-11913 vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: ..	9.8 Critical	—	0,56%	10 Jul 2026
CVE-2026-59155 Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoint...	6.9 Medium	—	0,39%	10 Jul 2026
CVE-2026-58591 colorbox project colorbox Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affect...	5.4 Medium	—	0,23%	10 Jul 2026
CVE-2026-58590 flowdrop project flowdrop Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.	5.4 Medium	—	0,23%	10 Jul 2026
CVE-2026-58589 flowdrop project flowdrop Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.	5.4 Medium	—	0,23%	10 Jul 2026
CVE-2026-58588 drupal canvas project drupal canvas Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue a...	6.1 Medium	—	0,26%	10 Jul 2026
CVE-2026-58587 drupal canvas project drupal canvas Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue a...	6.1 Medium	—	0,26%	10 Jul 2026
CVE-2026-58503 Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issue is fixed...	6.9 Medium	—	0,59%	10 Jul 2026
CVE-2026-57584 Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compi...	8.7 High	—	0,53%	10 Jul 2026
CVE-2026-55884 Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router...	9.2 Critical	—	0,50%	10 Jul 2026
CVE-2026-55883 Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but th...	8.3 High	—	0,26%	10 Jul 2026
CVE-2026-55882 Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug...	8.3 High	—	0,52%	10 Jul 2026
CVE-2026-55852 Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently...	8.6 High	—	0,68%	10 Jul 2026
CVE-2026-55810 plotly.js graphing Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plot...	8.1 High	—	0,43%	10 Jul 2026
CVE-2026-55809 flag attendance field project flag attendance field Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects F...	8.1 High	—	0,43%	10 Jul 2026
CVE-2026-55808 drupal Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue aff...	5.4 Medium	—	0,27%	10 Jul 2026
CVE-2026-55807 drupal Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12,...	3.1 Low	—	0,22%	10 Jul 2026
CVE-2026-55806 drupal URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10...	5.9 Medium	—	0,34%	10 Jul 2026
CVE-2026-55804 drupal Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core...	5.9 Medium	—	0,35%	10 Jul 2026
CVE-2026-55803 drupal Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core...	5.9 Medium	—	0,35%	10 Jul 2026
CVE-2026-55187 Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternalIP deny-lis...	5.8 Medium	—	0,35%	10 Jul 2026
CVE-2026-54736 Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly co...	8.2 High	—	0,18%	10 Jul 2026
CVE-2026-52761 owasp modsecurity ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformati...	5.3 Medium	—	0,41%	10 Jul 2026
CVE-2026-52747 owasp modsecurity ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parse...	8.6 High	—	0,48%	10 Jul 2026
CVE-2026-49844 apache log4j Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects...	5.9 Medium	—	0,60%	10 Jul 2026
CVE-2026-49394 Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public workspaces...	7.1 High	—	0,54%	10 Jul 2026
CVE-2026-49213 TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHttpReqUrl.ts can be bypassed with the IPv6 unspecifi...	8.1 High	—	0,41%	10 Jul 2026
CVE-2026-48127 Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API en...	5.3 Medium	—	0,61%	10 Jul 2026
CVE-2026-47422 Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fi...	5.3 Medium	—	0,38%	10 Jul 2026
CVE-2026-47199 Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potentially work...	2.3 Low	—	0,55%	10 Jul 2026
CVE-2026-44795 linuxfoundation spinnaker Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deseriali...	8.8 High	—	1,0%	10 Jul 2026
CVE-2026-42219 Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is...	6.9 Medium	—	0,68%	10 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.