Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-97471
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' p...
|
5.3 Medium | — | — | 14 Okt 2026 |
|
CVE-2026-97398
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including,...
|
7.2 High | — | — | 14 Okt 2026 |
|
CVE-2026-97020
The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to, and including, 1.4.2 due to insuffici...
|
6.4 Medium | — | — | 14 Okt 2026 |
|
CVE-2026-96661
The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to...
|
7.5 High | — | — | 14 Okt 2026 |
|
CVE-2026-95816
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all vers...
|
7.2 High | — | — | 14 Okt 2026 |
|
CVE-2026-95808
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all ver...
|
7.5 High | — | — | 14 Okt 2026 |
|
CVE-2026-95807
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to in...
|
6.4 Medium | — | — | 14 Okt 2026 |
|
CVE-2026-94377
The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including...
|
7.2 High | — | — | 14 Okt 2026 |
|
CVE-2026-93885
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions u...
|
7.2 High | — | — | 14 Okt 2026 |
|
CVE-2026-87855
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. Th...
|
9.8 Critical | — | — | 14 Okt 2026 |
|
CVE-2026-83592
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2...
|
7.2 High | — | — | 14 Okt 2026 |
|
CVE-2026-78193
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including...
|
7.5 High | — | — | 14 Okt 2026 |
|
CVE-2026-77114
The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including,...
|
7.2 High | — | — | 14 Okt 2026 |
|
CVE-2026-16495
The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in all versions up to, and...
|
6.4 Medium | — | — | 14 Okt 2026 |
|
CVE-2026-110449
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishan...
|
7.5 High | — | — | 14 Okt 2026 |
|
CVE-2026-104800
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This...
|
9.8 Critical | — | — | 14 Okt 2026 |
|
CVE-2026-100193
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, a...
|
4.7 Medium | — | — | 14 Okt 2026 |
|
CVE-2026-100185
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in a...
|
6.4 Medium | — | — | 14 Okt 2026 |
|
CVE-2026-100153
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1....
|
7.2 High | — | — | 14 Okt 2026 |
|
CVE-2026-97668
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including,...
|
9.8 Critical | — | — | 14 Okt 2026 |
|
CVE-2026-97657
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and...
|
9.8 Critical | — | — | 14 Okt 2026 |
|
CVE-2026-14765
Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL)...
|
7.7 High | — | — | 14 Okt 2026 |
|
CVE-2026-110447
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and Octobe...
|
9.2 Critical | — | — | 14 Okt 2026 |
|
CVE-2026-110445
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted con...
|
8.8 High | — | — | 14 Okt 2026 |
|
CVE-2026-110444
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to in...
|
8.8 High | — | — | 14 Okt 2026 |
|
CVE-2026-110002
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is...
|
9.8 Critical | — | — | 14 Okt 2026 |
|
CVE-2026-103422
The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insuffi...
|
7.2 High | — | — | 14 Okt 2026 |
|
CVE-2026-102251
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8...
|
7.5 High | — | — | 14 Okt 2026 |
|
CVE-2026-93388
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versi...
|
9.8 Critical | — | — | 14 Okt 2026 |
|
CVE-2026-92097
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dia...
|
9.1 Critical | — | — | 14 Okt 2026 |
|
CVE-2026-86607
Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator.
This issue affects Hitachi Ops Center Administrator: before 11.0.9-01.
|
4.3 Medium | — | — | 14 Okt 2026 |
|
CVE-2026-86573
Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.
This issue affects Hitachi Disk Array Driver...
|
5.1 Medium | — | — | 14 Okt 2026 |
|
CVE-2026-82715
Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.
This issue affects Hitachi Disk Array Dr...
|
7.9 High | — | — | 14 Okt 2026 |
|
CVE-2026-17092
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,...
|
8.1 High | — | — | 14 Okt 2026 |
|
CVE-2026-110392
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.
|
9.8 Critical | — | — | 14 Okt 2026 |
|
CVE-2026-107652
The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the pl...
|
5.3 Medium | — | — | 14 Okt 2026 |
|
CVE-2026-104995
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the clien...
|
8.1 High | — | — | 14 Okt 2026 |
|
CVE-2026-104767
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828...
|
7.5 High | — | — | 14 Okt 2026 |
|
CVE-2026-104749
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-executio...
|
7.5 High | — | — | 14 Okt 2026 |
|
CVE-2026-103425
The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insuffici...
|
6.4 Medium | — | — | 14 Okt 2026 |
|
CVE-2026-103423
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifyi...
|
7.5 High | — | — | 14 Okt 2026 |
|
CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute ar...
|
8.7 High | — | — | 14 Okt 2026 |
|
CVE-2026-110359
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\De...
|
7.8 High | — | — | 14 Okt 2026 |
|
CVE-2026-108473
Multiple
Kasa devices contain an improper authentication vulnerability in the local
device-management protocol. An unauthenticated adjacent attacker may send
management i...
|
8.7 High | — | — | 14 Okt 2026 |
|
CVE-2026-92817
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision projec...
|
8.8 High | — | — | 14 Okt 2026 |
|
CVE-2026-88964
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclos...
|
7.1 High | — | — | 13 Okt 2026 |
|
CVE-2026-53564
Vulnerability in Citrix UniconOS leading to Arbitrary file read and write
This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.
|
5.1 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-53563
Vulnerability in Citrix UniconOS leading to Persistent Command Execution
This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.
|
6.9 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-15468
Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.
This issue affects HYPR Passwordless: before...
|
6.9 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-105390
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a c...
|
6.9 Medium | — | — | 13 Okt 2026 |