Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-25434
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
|
8.5 High | — | 0,34% | 6 Okt 2026 |
|
CVE-2026-25433
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
|
7.1 High | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-105879
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS....
|
6.5 Medium | — | 0,17% | 6 Okt 2026 |
|
CVE-2026-105809
A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the compon...
|
4.3 Medium | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-105808
A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Execu...
|
3.5 Low | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-105317
Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
|
8.5 High | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-105071
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.
|
7.5 High | — | 0,40% | 6 Okt 2026 |
|
CVE-2026-105070
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
|
8.8 High | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-105061
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-105059
Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Contro...
|
6.5 Medium | — | 0,38% | 6 Okt 2026 |
|
CVE-2026-105058
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
|
8.8 High | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-105057
Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.
|
5.3 Medium | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-104814
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-104757
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
|
7.2 High | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-104747
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
|
8.1 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-104672
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
|
7.1 High | — | 0,18% | 6 Okt 2026 |
|
CVE-2026-104670
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
|
7.1 High | — | 0,18% | 6 Okt 2026 |
|
CVE-2026-104406
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
|
7.3 High | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-104405
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
|
8.1 High | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-104399
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data.
This issue affects Motors: from n/a thr...
|
6.9 Medium | — | 0,41% | 6 Okt 2026 |
|
CVE-2026-104395
Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-104394
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
|
7.1 High | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-104387
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
|
7.2 High | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-104385
Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.
|
7.5 High | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-103346
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Ref...
|
7.1 High | — | 0,15% | 6 Okt 2026 |
|
CVE-2026-102915
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
|
8.5 High | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-102387
Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
|
7.5 High | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-100518
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
|
5.3 Medium | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-85153
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker...
|
9.3 Critical | — | 0,37% | 6 Okt 2026 |
|
CVE-2026-105807
A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation res...
|
7.3 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-105305
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabil...
|
5.4 Medium | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-94299
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowin...
|
6.5 Medium | — | 0,16% | 6 Okt 2026 |
|
CVE-2026-94278
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file...
|
5.5 Medium | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-94293
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
|
9.8 Critical | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-94271
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does...
|
5.3 Medium | — | 0,18% | 6 Okt 2026 |
|
CVE-2026-94270
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification dis...
|
5.3 Medium | — | 0,18% | 6 Okt 2026 |
|
CVE-2026-89289
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to...
|
5.3 Medium | — | 0,18% | 6 Okt 2026 |
|
CVE-2026-86786
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retriev...
|
5.3 Medium | — | 0,21% | 6 Okt 2026 |
|
CVE-2026-59358
Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a f...
|
7.6 High | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-59357
Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UA...
|
6.5 Medium | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-57559
qualcomm cologne firmware, qualcomm fastconnect 6700 firmware +20 lainnya
Memory corruption while processing service requests.
|
7.8 High | — | 0,07% | 6 Okt 2026 |
|
CVE-2026-57555
qualcomm cologne firmware, qualcomm fastconnect 6700 firmware +20 lainnya
Memory Corruption when executing system service routines due to improper handling of user input buffers.
|
7.8 High | — | 0,07% | 6 Okt 2026 |
|
CVE-2026-57554
qualcomm snapdragon g1 gen 2 gaming platform firmware, qualcomm ar8031 firmware +58 lainnya
Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
|
7.8 High | — | 0,07% | 6 Okt 2026 |
|
CVE-2026-57546
qualcomm congo firmware, qualcomm fastconnect 7800 firmware +12 lainnya
Transient DOS when processing a continuous receive command with a zero-sized global configuration override.
|
7.5 High | — | 0,17% | 6 Okt 2026 |
|
CVE-2026-57545
qualcomm snapdragon g1 gen 2 gaming platform firmware, qualcomm ar8031 firmware +58 lainnya
Memory corruption when processing draw objects of incorrect type during graphics command list execution.
|
7.8 High | — | 0,08% | 6 Okt 2026 |
|
CVE-2026-57537
qualcomm congo firmware, qualcomm fastconnect 6200 firmware +58 lainnya
Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.
|
7.8 High | — | 0,07% | 6 Okt 2026 |
|
CVE-2026-25302
qualcomm xrv9209 firmware, qualcomm snapdragon g1 gen 2 gaming platform firmware +58 lainnya
Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processe...
|
7.1 High | — | 0,06% | 6 Okt 2026 |
|
CVE-2026-25291
qualcomm sar1165p firmware, qualcomm sc8380xp firmware +58 lainnya
Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
|
7.8 High | — | 0,07% | 6 Okt 2026 |
|
CVE-2026-25274
qualcomm aqt1000 firmware, qualcomm cologne firmware +43 lainnya
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
|
6.7 Medium | — | 0,07% | 6 Okt 2026 |
|
CVE-2026-25273
qualcomm congo firmware, qualcomm cq8845s firmware +49 lainnya
Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.
|
6.7 Medium | — | 0,07% | 6 Okt 2026 |