Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-97332
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on t...
|
5.3 Medium | — | 0,20% | 4 Okt 2026 |
|
CVE-2026-93549
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection fo...
|
8.8 High | — | 0,14% | 4 Okt 2026 |
|
CVE-2026-86817
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing aut...
|
4.9 Medium | — | 0,23% | 4 Okt 2026 |
|
CVE-2026-17005
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute c...
|
6.8 Medium | — | 0,24% | 4 Okt 2026 |
|
CVE-2026-105135
A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Pl...
|
10.0 Critical | — | 0,77% | 4 Okt 2026 |
|
CVE-2026-105134
ahsay cloud backup suite
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Re...
|
10.0 Critical | KEV | 4,8% | 4 Okt 2026 |
|
CVE-2026-105133
ahsay cloud backup suite
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component AP...
|
7.3 High | KEV | 0,85% | 4 Okt 2026 |
|
CVE-2026-104119
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-p...
|
3.5 Low | — | 0,14% | 4 Okt 2026 |
|
CVE-2026-104118
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthent...
|
5.3 Medium | — | 0,18% | 4 Okt 2026 |
|
CVE-2026-105099
A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component...
|
3.5 Low | — | 0,19% | 4 Okt 2026 |
|
CVE-2026-88779
Citrix NetScaler
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gatew...
|
8.7 High | KEV | 0,59% | 4 Okt 2026 |
|
CVE-2026-105098
A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support Ticket API...
|
4.3 Medium | — | 0,28% | 4 Okt 2026 |
|
CVE-2026-105097
A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Informatio...
|
4.3 Medium | — | 0,29% | 4 Okt 2026 |
|
CVE-2026-105131
ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/token...
|
5.4 Medium | — | 0,20% | 4 Okt 2026 |
|
CVE-2026-105096
A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Execut...
|
6.3 Medium | — | 0,29% | 4 Okt 2026 |
|
CVE-2026-105130
LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass the per-IP d...
|
3.7 Low | — | 0,22% | 4 Okt 2026 |
|
CVE-2026-105129
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets thr...
|
6.5 Medium | — | 0,31% | 4 Okt 2026 |
|
CVE-2026-105128
LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to Em...
|
5.4 Medium | — | 0,26% | 4 Okt 2026 |
|
CVE-2026-105127
LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid Abstrac...
|
5.3 Medium | — | 0,41% | 4 Okt 2026 |
|
CVE-2026-105126
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming...
|
7.2 High | — | 0,49% | 4 Okt 2026 |
|
CVE-2026-105125
LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On W...
|
3.7 Low | — | 0,31% | 4 Okt 2026 |
|
CVE-2026-105124
W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user fi...
|
6.1 Medium | — | 0,22% | 4 Okt 2026 |
|
CVE-2026-105123
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidat...
|
8.8 High | — | 0,52% | 4 Okt 2026 |
|
CVE-2026-96451
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate...
|
8.8 High | — | 0,30% | 3 Okt 2026 |
|
CVE-2026-103342
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, A...
|
7.1 High | — | 0,15% | 3 Okt 2026 |
|
CVE-2026-103065
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects...
|
8.2 High | — | 0,21% | 3 Okt 2026 |
|
CVE-2026-105122
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal...
|
5.4 Medium | — | 0,23% | 3 Okt 2026 |
|
CVE-2026-105121
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks u...
|
4.9 Medium | — | 0,25% | 3 Okt 2026 |
|
CVE-2026-105120
OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of eve...
|
4.9 Medium | — | 0,26% | 3 Okt 2026 |
|
CVE-2026-105119
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Conne...
|
6.8 Medium | — | 0,20% | 3 Okt 2026 |
|
CVE-2026-105118
OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oaut...
|
4.7 Medium | — | 0,10% | 3 Okt 2026 |
|
CVE-2026-105117
OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword...
|
6.1 Medium | — | 0,16% | 3 Okt 2026 |
|
CVE-2026-105116
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce...
|
6.1 Medium | — | 0,16% | 3 Okt 2026 |
|
CVE-2026-105115
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load cla...
|
8.6 High | — | 0,46% | 3 Okt 2026 |
|
CVE-2026-105114
OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters render...
|
6.1 Medium | — | 0,17% | 3 Okt 2026 |
|
CVE-2026-105113
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non...
|
6.5 Medium | — | 0,20% | 3 Okt 2026 |
|
CVE-2026-105112
Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem...
|
5.3 Medium | — | 0,18% | 3 Okt 2026 |
|
CVE-2026-105105
CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unau...
|
9.8 Critical | — | 0,78% | 3 Okt 2026 |
|
CVE-2026-104983
A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment...
|
6.3 Medium | — | 0,43% | 3 Okt 2026 |
|
CVE-2026-97873
In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iter...
|
5.3 Medium | — | 0,26% | 3 Okt 2026 |
|
CVE-2026-85515
In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check...
|
8.2 High | — | 0,16% | 3 Okt 2026 |
|
CVE-2026-71892
In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidati...
|
6.9 Medium | — | 0,17% | 3 Okt 2026 |
|
CVE-2026-71891
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession ve...
|
7.1 High | — | 0,17% | 3 Okt 2026 |
|
CVE-2026-71890
In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposal...
|
8.7 High | — | 0,25% | 3 Okt 2026 |
|
CVE-2026-71889
In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXC...
|
8.7 High | — | 0,17% | 3 Okt 2026 |
|
CVE-2026-71888
In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether au...
|
8.7 High | — | 0,11% | 3 Okt 2026 |
|
CVE-2026-71887
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Pr...
|
8.2 High | — | 0,09% | 3 Okt 2026 |
|
CVE-2026-71886
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issui...
|
8.2 High | — | 0,17% | 3 Okt 2026 |
|
CVE-2026-71885
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNod...
|
9.2 Critical | — | 0,19% | 3 Okt 2026 |
|
CVE-2026-71883
In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional...
|
8.2 High | — | 0,25% | 3 Okt 2026 |