Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-104393
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stor...
|
6.5 Medium | — | 0,13% | 7 Okt 2026 |
|
CVE-2026-104391
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XS...
|
6.5 Medium | — | 0,13% | 7 Okt 2026 |
|
CVE-2026-104390
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: fr...
|
4.3 Medium | — | 0,21% | 7 Okt 2026 |
|
CVE-2026-103075
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle:...
|
4.3 Medium | — | 0,26% | 7 Okt 2026 |
|
CVE-2026-97720
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources ser...
|
9.1 Critical | — | 0,32% | 7 Okt 2026 |
|
CVE-2026-93684
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when...
|
5.4 Medium | — | 0,16% | 7 Okt 2026 |
|
CVE-2026-93026
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.
|
6.1 Medium | — | 0,30% | 7 Okt 2026 |
|
CVE-2026-90466
apache impala
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'tru...
|
6.5 Medium | — | 0,50% | 7 Okt 2026 |
|
CVE-2026-89417
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom F...
|
7.2 High | — | 0,25% | 7 Okt 2026 |
|
CVE-2026-58069
This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.
|
8.3 High | — | 0,37% | 7 Okt 2026 |
|
CVE-2026-58068
This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.
|
6.8 Medium | — | 0,10% | 7 Okt 2026 |
|
CVE-2026-5703
Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to...
|
7.1 High | — | 0,29% | 7 Okt 2026 |
|
CVE-2026-19186
ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without first check...
|
8.1 High | — | 0,21% | 7 Okt 2026 |
|
CVE-2026-15894
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buff...
|
8.8 High | — | 0,31% | 7 Okt 2026 |
|
CVE-2026-107104
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could...
|
9.3 Critical | — | 0,42% | 7 Okt 2026 |
|
CVE-2026-107103
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attac...
|
9.3 Critical | — | 0,33% | 7 Okt 2026 |
|
CVE-2026-107102
This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthent...
|
9.3 Critical | — | 0,26% | 7 Okt 2026 |
|
CVE-2026-103416
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes p...
|
9.3 Critical | — | 0,21% | 7 Okt 2026 |
|
CVE-2026-102782
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no a...
|
9.3 Critical | — | 0,28% | 7 Okt 2026 |
|
CVE-2026-102781
Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s core com_a...
|
6.9 Medium | — | 0,24% | 7 Okt 2026 |
|
CVE-2025-64393
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
|
9.4 Critical | — | 0,36% | 7 Okt 2026 |
|
CVE-2025-64392
This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.
|
4.8 Medium | — | 0,34% | 7 Okt 2026 |
|
CVE-2025-64391
This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator inst...
|
4.1 Medium | — | 0,12% | 7 Okt 2026 |
|
CVE-2026-107121
A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an e...
|
6.5 Medium | — | 0,08% | 7 Okt 2026 |
|
CVE-2026-97354
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allow...
|
4.1 Medium | — | 0,18% | 7 Okt 2026 |
|
CVE-2026-97331
The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email...
|
4.3 Medium | — | 0,18% | 7 Okt 2026 |
|
CVE-2026-97188
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor,...
|
8.8 High | — | 0,38% | 7 Okt 2026 |
|
CVE-2026-96530
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowin...
|
6.5 Medium | — | 0,22% | 7 Okt 2026 |
|
CVE-2026-87971
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page,...
|
7.1 High | — | 0,15% | 7 Okt 2026 |
|
CVE-2026-87782
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allo...
|
8.8 High | — | 0,23% | 7 Okt 2026 |
|
CVE-2026-86833
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, all...
|
5.4 Medium | — | 0,16% | 7 Okt 2026 |
|
CVE-2026-86816
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data...
|
5.3 Medium | — | 0,23% | 7 Okt 2026 |
|
CVE-2026-82212
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target...
|
7.5 High | — | 0,13% | 7 Okt 2026 |
|
CVE-2026-82211
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitr...
|
8.2 High | — | 0,19% | 7 Okt 2026 |
|
CVE-2026-105322
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to...
|
5.3 Medium | — | 0,19% | 7 Okt 2026 |
|
CVE-2026-105316
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, bef...
|
7.1 High | — | 0,16% | 7 Okt 2026 |
|
CVE-2026-104953
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Edit...
|
6.8 Medium | — | 0,23% | 7 Okt 2026 |
|
CVE-2026-104678
The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to...
|
2.7 Low | — | 0,17% | 7 Okt 2026 |
|
CVE-2026-104677
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Edito...
|
7.2 High | — | 0,37% | 7 Okt 2026 |
|
CVE-2026-104667
The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that...
|
6.8 Medium | — | 0,23% | 7 Okt 2026 |
|
CVE-2026-104653
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them...
|
6.8 Medium | — | 0,24% | 7 Okt 2026 |
|
CVE-2026-104651
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its ord...
|
4.3 Medium | — | 0,15% | 7 Okt 2026 |
|
CVE-2026-104050
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning tha...
|
4.3 Medium | — | 0,16% | 7 Okt 2026 |
|
CVE-2026-104049
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes,...
|
4.3 Medium | — | 0,16% | 7 Okt 2026 |
|
CVE-2026-103681
The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, suc...
|
4.3 Medium | — | 0,15% | 7 Okt 2026 |
|
CVE-2026-103378
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory,...
|
6.5 Medium | — | 0,18% | 7 Okt 2026 |
|
CVE-2026-103323
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated...
|
5.9 Medium | — | 0,20% | 7 Okt 2026 |
|
CVE-2026-104652
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users w...
|
6.8 Medium | — | 0,24% | 7 Okt 2026 |
|
CVE-2026-59347
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may...
|
8.1 High | — | 0,21% | 7 Okt 2026 |
|
CVE-2026-59346
VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual...
|
9.3 Critical | — | 0,26% | 7 Okt 2026 |