Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-104974
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing crede...
|
8.1 High | — | 0,50% | 5 Okt 2026 |
|
CVE-2026-104973
Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/pl...
|
7.6 High | — | 0,27% | 5 Okt 2026 |
|
CVE-2026-104971
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing...
|
8.5 High | — | 0,35% | 5 Okt 2026 |
|
CVE-2026-104905
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unser...
|
8.1 High | — | 0,51% | 5 Okt 2026 |
|
CVE-2026-102576
A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application do...
|
4.2 Medium | — | 0,29% | 5 Okt 2026 |
|
CVE-2026-102295
A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a...
|
5.4 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-101919
A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane na...
|
8.8 High | — | 0,42% | 5 Okt 2026 |
|
CVE-2025-15643
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This i...
|
7.1 High | — | 0,15% | 5 Okt 2026 |
|
CVE-2026-86671
In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, w...
|
8.4 High | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-78412
Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org i...
|
4.9 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-12171
auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options,...
|
7.8 High | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-105383
A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file ph...
|
7.3 High | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-105382
A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount of the file...
|
7.3 High | — | 0,29% | 5 Okt 2026 |
|
CVE-2026-104970
Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses Inst...
|
8.1 High | — | 0,27% | 5 Okt 2026 |
|
CVE-2026-104969
Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to...
|
6.5 Medium | — | 0,27% | 5 Okt 2026 |
|
CVE-2026-104968
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names,...
|
8.7 High | — | 0,31% | 5 Okt 2026 |
|
CVE-2026-104967
Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-sup...
|
5.4 Medium | — | 0,18% | 5 Okt 2026 |
|
CVE-2026-104966
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project...
|
8.7 High | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-104965
Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong t...
|
5.4 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-104964
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but l...
|
6.8 Medium | — | 0,29% | 5 Okt 2026 |
|
CVE-2026-104963
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules...
|
4.3 Medium | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-104962
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster,...
|
6.5 Medium | — | 0,30% | 5 Okt 2026 |
|
CVE-2026-104961
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a workspace owne...
|
5.4 Medium | — | 0,18% | 5 Okt 2026 |
|
CVE-2026-104960
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ en...
|
6.5 Medium | — | 0,32% | 5 Okt 2026 |
|
CVE-2026-104956
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters and passes...
|
5.3 Medium | — | 0,38% | 5 Okt 2026 |
|
CVE-2026-104955
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/work...
|
5.4 Medium | — | 0,19% | 5 Okt 2026 |
|
CVE-2026-104894
Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the calle...
|
4.3 Medium | — | 0,24% | 5 Okt 2026 |
|
CVE-2026-104893
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/u...
|
5.4 Medium | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-102779
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `recor...
|
6.9 Medium | — | 0,39% | 5 Okt 2026 |
|
CVE-2026-102777
svenbluege event gallery
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end u...
|
6.5 Medium | — | 0,27% | 5 Okt 2026 |
|
CVE-2026-102282
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry direct...
|
7.1 High | — | 0,15% | 5 Okt 2026 |
|
CVE-2026-88396
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension ver...
|
7.2 High | — | 1,0% | 5 Okt 2026 |
|
CVE-2026-88397
ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
|
6.5 Medium | — | 0,27% | 5 Okt 2026 |
|
CVE-2026-88393
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly in...
|
9.8 Critical | — | 0,39% | 5 Okt 2026 |
|
CVE-2026-88395
GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
|
9.8 Critical | — | 0,39% | 5 Okt 2026 |
|
CVE-2026-37719
An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
|
9.8 Critical | — | 0,74% | 5 Okt 2026 |
|
CVE-2026-105397
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz ques...
|
5.4 Medium | — | 0,17% | 5 Okt 2026 |
|
CVE-2026-105329
A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the compon...
|
6.3 Medium | — | 0,40% | 5 Okt 2026 |
|
CVE-2026-104892
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user A...
|
8.7 High | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-104891
mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate...
|
7.5 High | — | 0,28% | 5 Okt 2026 |
|
CVE-2026-104890
Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs t...
|
7.2 High | — | 0,42% | 5 Okt 2026 |
|
CVE-2026-102780
techfry tf content
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes bot...
|
9.8 Critical | — | 0,29% | 5 Okt 2026 |
|
CVE-2026-102778
svenbluege event gallery
Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (...
|
6.1 Medium | — | 0,09% | 5 Okt 2026 |
|
CVE-2026-102776
svenbluege event gallery
Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of the back-...
|
4.3 Medium | — | 0,10% | 5 Okt 2026 |
|
CVE-2026-102775
phoca cart
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoin...
|
7.5 High | — | 0,37% | 5 Okt 2026 |
|
CVE-2026-102428
ordasoft joomla cck
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validate...
|
9.8 Critical | — | 0,32% | 5 Okt 2026 |
|
CVE-2026-102426
ollyo sp page builder
Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are t...
|
6.1 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-89039
A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file re...
|
6.5 Medium | — | 0,38% | 5 Okt 2026 |
|
CVE-2026-88394
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server w...
|
7.5 High | — | 0,57% | 5 Okt 2026 |
|
CVE-2026-88392
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.
|
7.5 High | — | 0,69% | 5 Okt 2026 |