Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-98173
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free of iface in cifs_try_adding_channels()
cifs_try_adding_channels() it...
|
7.5 High | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-98171
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
Fix several related bounds...
|
8.8 High | — | 0,51% | 6 Okt 2026 |
|
CVE-2026-98169
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential OOB read in smb3_enum_snapshots()
If snapshot_array_size is smaller than...
|
7.1 High | — | 0,43% | 6 Okt 2026 |
|
CVE-2026-98166
In the Linux kernel, the following vulnerability has been resolved:
drm/ttm: fix swapped-out resources never leaving their bulk_move range
ttm_tt_swapout() returns the...
|
7.8 High | — | 0,15% | 6 Okt 2026 |
|
CVE-2026-97308
Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.
|
4.8 Medium | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-95594
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects...
|
8.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-95526
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
|
7.3 High | — | 0,23% | 6 Okt 2026 |
|
CVE-2026-95105
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access t...
|
8.2 High | — | 0,11% | 6 Okt 2026 |
|
CVE-2026-94675
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.
|
7.1 High | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-94206
Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed...
|
6.3 Medium | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-62072
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
|
8.8 High | — | 0,34% | 6 Okt 2026 |
|
CVE-2026-4889
SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The...
|
7.8 High | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-48199
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
|
7.5 High | — | 0,39% | 6 Okt 2026 |
|
CVE-2026-48197
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishP...
|
7.2 High | — | 0,46% | 6 Okt 2026 |
|
CVE-2026-42638
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels...
|
7.5 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-42637
Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
|
6.5 Medium | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-42636
Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.
|
7.1 High | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-42635
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
|
7.1 High | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-42634
Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
|
7.1 High | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-42418
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This i...
|
7.1 High | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-42417
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
|
9.3 Critical | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-42416
Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.
|
8.5 High | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-42415
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
|
9.3 Critical | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-42414
Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
|
8.5 High | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-42413
Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.
|
7.5 High | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-41562
Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.
|
7.5 High | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-41561
Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.
|
7.5 High | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-41560
Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.
|
7.5 High | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-41559
Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions.
|
7.5 High | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-41555
Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.
|
9.3 Critical | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-40807
Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.
|
7.1 High | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-40806
Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.
|
7.1 High | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-39798
Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.
|
6.5 Medium | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-39797
Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
|
9.8 Critical | — | 0,34% | 6 Okt 2026 |
|
CVE-2026-39796
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.
|
7.5 High | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-39795
Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.
|
9.3 Critical | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-39794
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.
|
7.5 High | — | 0,39% | 6 Okt 2026 |
|
CVE-2026-39793
Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.
|
8.8 High | — | 0,42% | 6 Okt 2026 |
|
CVE-2026-39792
Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.
|
8.6 High | — | 0,36% | 6 Okt 2026 |
|
CVE-2026-39791
Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.
|
5.3 Medium | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-39790
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affec...
|
7.1 High | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-39788
Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.
|
6.5 Medium | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-39787
Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
|
6.5 Medium | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-39785
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Inje...
|
9.3 Critical | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-39784
Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.
|
7.1 High | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-39781
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS....
|
7.1 High | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-39780
Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
|
7.1 High | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-39778
Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.
|
7.1 High | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-39776
Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.
|
8.0 High | — | 0,38% | 6 Okt 2026 |
|
CVE-2026-39775
Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.
|
8.8 High | — | 0,34% | 6 Okt 2026 |