Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-85487
broadcom brocade active support connectivity gateway
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a m...
|
8.8 High | — | 0,24% | 8 Okt 2026 |
|
CVE-2026-85486
broadcom brocade active support connectivity gateway
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submit...
|
8.0 High | — | 0,29% | 8 Okt 2026 |
|
CVE-2026-85423
broadcom brocade active support connectivity gateway
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perfo...
|
8.8 High | — | 0,24% | 8 Okt 2026 |
|
CVE-2026-85422
broadcom brocade active support connectivity gateway
A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive...
|
7.8 High | — | 0,10% | 8 Okt 2026 |
|
CVE-2026-85421
broadcom brocade active support connectivity gateway
A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control...
|
8.8 High | — | 0,22% | 8 Okt 2026 |
|
CVE-2026-85097
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validat...
|
9.8 Critical | — | 0,31% | 8 Okt 2026 |
|
CVE-2026-94275
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attac...
|
5.3 Medium | — | 0,21% | 8 Okt 2026 |
|
CVE-2026-94258
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing ph...
|
2.7 Low | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-94246
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, a...
|
6.3 Medium | — | 0,15% | 8 Okt 2026 |
|
CVE-2026-94245
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any au...
|
6.5 Medium | — | 0,17% | 8 Okt 2026 |
|
CVE-2026-94244
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a fro...
|
4.3 Medium | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-86828
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library i...
|
6.6 Medium | — | 0,42% | 8 Okt 2026 |
|
CVE-2026-86827
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal sc...
|
5.3 Medium | — | 0,22% | 8 Okt 2026 |
|
CVE-2026-86826
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attack...
|
5.9 Medium | — | 0,22% | 8 Okt 2026 |
|
CVE-2026-5769
broadcom brocade sannav
A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting...
|
4.1 Medium | — | 0,07% | 8 Okt 2026 |
|
CVE-2026-5049
broadcom brocade sannav
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded conten...
|
5.7 Medium | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-5048
broadcom brocade sannav
In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject m...
|
8.0 High | — | 0,23% | 8 Okt 2026 |
|
CVE-2026-5047
broadcom brocade sannav
A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated...
|
5.7 Medium | — | 0,20% | 8 Okt 2026 |
|
CVE-2026-107459
The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on t...
|
9.8 Critical | — | 1,5% | 8 Okt 2026 |
|
CVE-2026-105260
The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability chec...
|
4.3 Medium | — | 0,10% | 8 Okt 2026 |
|
CVE-2026-105198
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that...
|
5.3 Medium | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-105197
The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion,...
|
2.7 Low | — | 0,17% | 8 Okt 2026 |
|
CVE-2026-105196
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authentica...
|
3.3 Low | — | 0,13% | 8 Okt 2026 |
|
CVE-2026-105195
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allo...
|
2.7 Low | — | 0,23% | 8 Okt 2026 |
|
CVE-2026-105194
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view...
|
4.3 Medium | — | 0,22% | 8 Okt 2026 |
|
CVE-2026-105193
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded va...
|
4.8 Medium | — | 0,12% | 8 Okt 2026 |
|
CVE-2026-104646
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery...
|
6.8 Medium | — | 0,29% | 8 Okt 2026 |
|
CVE-2026-104645
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, che...
|
2.7 Low | — | 0,21% | 8 Okt 2026 |
|
CVE-2026-103692
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker...
|
9.8 Critical | — | 0,34% | 8 Okt 2026 |
|
CVE-2026-103646
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress...
|
9.8 Critical | — | 0,44% | 8 Okt 2026 |
|
CVE-2026-103309
The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages,...
|
7.5 High | — | 0,27% | 8 Okt 2026 |
|
CVE-2026-94587
broadcom fabric operating system
A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions...
|
4.5 Medium | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-94586
broadcom fabric operating system
A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS version...
|
6.8 Medium | — | 1,4% | 8 Okt 2026 |
|
CVE-2026-94585
broadcom fabric operating system
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticat...
|
8.8 High | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-94581
broadcom fabric operating system
An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authen...
|
6.8 Medium | — | 1,5% | 8 Okt 2026 |
|
CVE-2026-94579
broadcom fabric operating system
An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS ver...
|
8.0 High | — | 3,1% | 8 Okt 2026 |
|
CVE-2026-94577
broadcom fabric operating system
A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and...
|
7.8 High | — | 0,10% | 8 Okt 2026 |
|
CVE-2026-94576
broadcom fabric operating system
An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 1...
|
8.0 High | — | 0,43% | 8 Okt 2026 |
|
CVE-2026-87677
broadcom fabric operating system
An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administ...
|
6.6 Medium | — | 0,61% | 8 Okt 2026 |
|
CVE-2026-87664
broadcom fabric operating system
A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-...
|
7.8 High | — | 0,12% | 8 Okt 2026 |
|
CVE-2026-87663
broadcom fabric operating system
An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 th...
|
6.7 Medium | — | 0,67% | 8 Okt 2026 |
|
CVE-2026-87662
broadcom fabric operating system
Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade...
|
6.7 Medium | — | 0,25% | 8 Okt 2026 |
|
CVE-2026-87661
broadcom fabric operating system
Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacke...
|
5.7 Medium | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-17609
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit...
|
9.1 Critical | — | 0,31% | 8 Okt 2026 |
|
CVE-2026-17196
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploa...
|
8.8 High | — | 0,53% | 8 Okt 2026 |
|
CVE-2026-107450
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList...
|
5.4 Medium | — | 0,21% | 8 Okt 2026 |
|
CVE-2026-107449
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occu...
|
3.4 Low | — | 0,16% | 8 Okt 2026 |
|
CVE-2023-5649
broadcom brocade active support connectivity gateway
An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide invalid input...
|
5.5 Medium | — | 0,09% | 8 Okt 2026 |
|
CVE-2023-5648
broadcom brocade active support connectivity gateway
In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perfor...
|
6.1 Medium | — | 0,16% | 8 Okt 2026 |
|
CVE-2026-94584
broadcom fabric operating system
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication reques...
|
2.6 Low | — | 0,14% | 8 Okt 2026 |