Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-104810
This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this v...
|
8.4 High | — | 0,35% | 5 Okt 2026 |
|
CVE-2026-104809
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module...
|
8.4 High | — | 0,09% | 5 Okt 2026 |
|
CVE-2026-104808
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content...
|
1.9 Low | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-104807
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content...
|
1.9 Low | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-104806
DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory.
The specific flaw exists within...
|
5.5 Medium | — | 0,31% | 5 Okt 2026 |
|
CVE-2026-104805
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce...
|
8.5 High | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-104706
DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administrat...
|
8.4 High | — | 0,14% | 5 Okt 2026 |
|
CVE-2026-104675
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This iss...
|
4.3 Medium | — | 0,17% | 5 Okt 2026 |
|
CVE-2026-104673
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-mus...
|
6.5 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-104409
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-galle...
|
6.5 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-104408
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This iss...
|
7.6 High | — | 0,28% | 5 Okt 2026 |
|
CVE-2026-104407
Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Pod...
|
7.1 High | — | 0,10% | 5 Okt 2026 |
|
CVE-2026-104404
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affe...
|
6.5 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-104401
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded...
|
4.3 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-104400
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Bl...
|
6.5 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-104397
Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe...
|
5.3 Medium | — | 0,23% | 5 Okt 2026 |
|
CVE-2026-104396
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This i...
|
6.5 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-104389
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: f...
|
8.5 High | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-104388
Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects PowerPress Podcastin...
|
5.3 Medium | — | 0,23% | 5 Okt 2026 |
|
CVE-2026-104386
Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/...
|
6.5 Medium | — | 0,15% | 5 Okt 2026 |
|
CVE-2026-103512
Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can b...
|
5.3 Medium | — | 0,37% | 5 Okt 2026 |
|
CVE-2026-103511
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges...
|
5.1 Medium | — | 0,33% | 5 Okt 2026 |
|
CVE-2026-103510
P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network ac...
|
9.5 Critical | — | 0,35% | 5 Okt 2026 |
|
CVE-2026-103507
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication toke...
|
7.5 High | — | 0,51% | 5 Okt 2026 |
|
CVE-2026-103351
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manip...
|
5.3 Medium | — | 0,23% | 5 Okt 2026 |
|
CVE-2026-103335
Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedd...
|
5.3 Medium | — | 0,28% | 5 Okt 2026 |
|
CVE-2026-103084
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor a...
|
6.5 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-103079
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Le...
|
5.4 Medium | — | 0,18% | 5 Okt 2026 |
|
CVE-2026-103078
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Le...
|
4.3 Medium | — | 0,21% | 5 Okt 2026 |
|
CVE-2026-102914
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This...
|
6.5 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-102393
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.Thi...
|
6.5 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-100103
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with netw...
|
10.0 Critical | — | 0,42% | 5 Okt 2026 |
|
CVE-2026-100102
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitr...
|
9.5 Critical | — | 0,36% | 5 Okt 2026 |
|
CVE-2026-105314
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packag...
|
7.5 High | — | 0,90% | 5 Okt 2026 |
|
CVE-2026-105250
A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decoder.c of the component Microsof...
|
4.3 Medium | — | 0,32% | 5 Okt 2026 |
|
CVE-2026-105249
A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handle...
|
4.8 Medium | — | 0,11% | 5 Okt 2026 |
|
CVE-2026-105248
A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_parser.c of the component TXTP F...
|
6.3 Medium | — | 0,24% | 5 Okt 2026 |
|
CVE-2026-105247
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessm...
|
7.3 High | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-19954
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.
pwhois encodes each no...
|
5.4 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-105246
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_...
|
7.3 High | — | 0,27% | 5 Okt 2026 |
|
CVE-2026-105245
A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt/entrypoints/http_server.py of...
|
3.7 Low | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-105238
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fa...
|
7.3 High | — | 0,39% | 5 Okt 2026 |
|
CVE-2019-25777
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.
A perl/glob documen...
|
7.3 High | — | 0,34% | 5 Okt 2026 |
|
CVE-2017-20285
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.
A perl/hash:Class tag blesses a hash into the class it nam...
|
9.1 Critical | — | 0,32% | 5 Okt 2026 |
|
CVE-2026-100727
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when...
|
6.9 Medium | — | 0,23% | 5 Okt 2026 |
|
CVE-2026-84169
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to...
|
5.3 Medium | — | 0,18% | 5 Okt 2026 |
|
CVE-2026-78371
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it,...
|
5.9 Medium | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-13607
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restric...
|
5.9 Medium | — | 0,29% | 5 Okt 2026 |
|
CVE-2026-105306
A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to...
|
6.5 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-105302
A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a...
|
5.7 Medium | — | 0,20% | 5 Okt 2026 |