Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-39774
Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.
|
8.8 High | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-39773
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
|
10.0 Critical | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-39772
Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.
|
5.3 Medium | — | 0,36% | 6 Okt 2026 |
|
CVE-2026-39771
Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.
|
8.5 High | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-39770
Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
|
10.0 Critical | — | 0,42% | 6 Okt 2026 |
|
CVE-2026-39769
Unauthenticated Broken Authentication in Graphina <= 3.1.12 versions.
|
7.5 High | — | 0,49% | 6 Okt 2026 |
|
CVE-2026-39767
Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.
|
6.5 Medium | — | 0,41% | 6 Okt 2026 |
|
CVE-2026-39766
Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
|
7.1 High | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-39765
Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.
|
7.2 High | — | 0,46% | 6 Okt 2026 |
|
CVE-2026-39764
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
|
9.3 Critical | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-39762
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured...
|
6.5 Medium | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-39761
Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.
|
9.8 Critical | — | 0,48% | 6 Okt 2026 |
|
CVE-2026-39759
Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
|
9.9 Critical | — | 0,48% | 6 Okt 2026 |
|
CVE-2026-39758
Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.
|
7.1 High | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-39757
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
|
9.9 Critical | — | 0,48% | 6 Okt 2026 |
|
CVE-2026-39756
Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.
|
6.5 Medium | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-39755
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
|
9.9 Critical | — | 0,45% | 6 Okt 2026 |
|
CVE-2026-39754
Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.
|
6.5 Medium | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-39753
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
|
9.8 Critical | — | 0,45% | 6 Okt 2026 |
|
CVE-2026-39752
Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.
|
7.7 High | — | 0,45% | 6 Okt 2026 |
|
CVE-2026-39751
Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
|
7.5 High | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-39750
Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-39749
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
|
6.5 Medium | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-39748
Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-39747
Subscriber SQL Injection in Woffice <= 5.4.35 versions.
|
8.5 High | — | 0,34% | 6 Okt 2026 |
|
CVE-2026-39746
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
|
9.3 Critical | — | 0,38% | 6 Okt 2026 |
|
CVE-2026-39745
Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-39731
Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-39730
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: fr...
|
7.1 High | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-39729
Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.
|
7.2 High | — | 0,34% | 6 Okt 2026 |
|
CVE-2026-39728
Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.
|
7.2 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-39727
Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.
|
6.5 Medium | — | 0,21% | 6 Okt 2026 |
|
CVE-2026-39726
Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-39724
Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-39722
Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-39720
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-39719
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
|
7.2 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-32581
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
|
7.1 High | — | 0,27% | 6 Okt 2026 |
|
CVE-2026-32580
Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
|
7.5 High | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-32579
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
|
10.0 Critical | — | 0,49% | 6 Okt 2026 |
|
CVE-2026-32578
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
|
7.1 High | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-32577
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-32575
Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-32574
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue a...
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-32572
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-32571
Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.
|
6.5 Medium | — | 0,21% | 6 Okt 2026 |
|
CVE-2026-32570
Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-32569
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-32568
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
|
9.9 Critical | — | 0,74% | 6 Okt 2026 |
|
CVE-2026-32557
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
|
9.3 Critical | — | 0,38% | 6 Okt 2026 |