Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-101928
The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1...
|
7.2 High | — | 0,32% | 3 Okt 2026 |
|
CVE-2026-101923
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin sto...
|
8.1 High | — | 0,34% | 3 Okt 2026 |
|
CVE-2026-101357
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter in al...
|
4.9 Medium | — | 0,24% | 3 Okt 2026 |
|
CVE-2026-101162
The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a...
|
6.4 Medium | — | 0,24% | 3 Okt 2026 |
|
CVE-2026-101161
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a f...
|
7.5 High | — | 0,34% | 3 Okt 2026 |
|
CVE-2026-101160
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operation...
|
7.5 High | — | 0,34% | 3 Okt 2026 |
|
CVE-2026-101159
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthe...
|
7.5 High | — | 0,25% | 3 Okt 2026 |
|
CVE-2026-100152
The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to arbitrary shortco...
|
6.5 Medium | — | 0,36% | 3 Okt 2026 |
|
CVE-2026-100149
The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i...
|
5.3 Medium | — | 0,32% | 3 Okt 2026 |
|
CVE-2026-100148
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and inclu...
|
6.4 Medium | — | 0,30% | 3 Okt 2026 |
|
CVE-2025-12828
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2...
|
6.4 Medium | — | 0,19% | 3 Okt 2026 |
|
CVE-2026-97644
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up t...
|
8.8 High | — | 0,50% | 3 Okt 2026 |
|
CVE-2026-92977
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including,...
|
7.2 High | — | 0,24% | 3 Okt 2026 |
|
CVE-2026-92826
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 du...
|
6.1 Medium | — | 0,22% | 3 Okt 2026 |
|
CVE-2026-92727
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scrip...
|
6.4 Medium | — | 0,20% | 3 Okt 2026 |
|
CVE-2026-92551
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected...
|
6.1 Medium | — | 0,22% | 3 Okt 2026 |
|
CVE-2026-92538
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby'...
|
6.1 Medium | — | 0,21% | 3 Okt 2026 |
|
CVE-2026-92536
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive...
|
8.8 High | — | 0,63% | 3 Okt 2026 |
|
CVE-2026-96270
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site...
|
7.2 High | — | 0,25% | 3 Okt 2026 |
|
CVE-2026-95865
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][value]' Parameter in all versions...
|
6.5 Medium | — | 0,27% | 3 Okt 2026 |
|
CVE-2026-94539
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in al...
|
6.5 Medium | — | 0,27% | 3 Okt 2026 |
|
CVE-2026-94378
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in al...
|
6.4 Medium | — | 0,20% | 3 Okt 2026 |
|
CVE-2026-93428
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization byp...
|
7.5 High | — | 0,52% | 3 Okt 2026 |
|
CVE-2026-92243
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including...
|
6.1 Medium | — | 0,21% | 3 Okt 2026 |
|
CVE-2026-100180
The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment...
|
5.4 Medium | — | 0,24% | 3 Okt 2026 |
|
CVE-2026-105090
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A wo...
|
5.1 Medium | — | 0,26% | 3 Okt 2026 |
|
CVE-2026-105083
imagemagick
ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alte...
|
4.2 Medium | — | 0,11% | 3 Okt 2026 |
|
CVE-2026-79113
OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow.
|
5.1 Medium | — | 0,14% | 3 Okt 2026 |
|
CVE-2026-105080
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable c...
|
9.9 Critical | — | 0,33% | 3 Okt 2026 |
|
CVE-2026-105030
Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying da...
|
5.3 Medium | — | 0,33% | 3 Okt 2026 |
|
CVE-2026-105029
UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authe...
|
4.3 Medium | — | 0,20% | 3 Okt 2026 |
|
CVE-2026-104479
Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions w...
|
5.4 Medium | — | 0,17% | 3 Okt 2026 |
|
CVE-2026-104478
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with...
|
7.1 High | — | 0,35% | 3 Okt 2026 |
|
CVE-2026-104477
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs pla...
|
6.1 Medium | — | 0,19% | 3 Okt 2026 |
|
CVE-2026-104476
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the se...
|
5.9 Medium | — | 0,29% | 3 Okt 2026 |
|
CVE-2026-104475
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. At...
|
5.4 Medium | — | 0,17% | 3 Okt 2026 |
|
CVE-2026-104474
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory...
|
6.7 Medium | — | 0,08% | 3 Okt 2026 |
|
CVE-2026-104433
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers t...
|
7.5 High | — | 0,37% | 3 Okt 2026 |
|
CVE-2026-84411
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can...
|
9.8 Critical | — | 0,95% | 2 Okt 2026 |
|
CVE-2026-105051
Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel).
|
1.9 Low | — | 0,08% | 2 Okt 2026 |
|
CVE-2026-105050
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the...
|
7.1 High | — | 0,52% | 2 Okt 2026 |
|
CVE-2026-105049
Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.
|
5.8 Medium | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-105048
The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).
|
4.0 Medium | — | 0,19% | 2 Okt 2026 |
|
CVE-2026-97363
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduc...
|
7.5 High | — | 0,32% | 2 Okt 2026 |
|
CVE-2026-97212
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This im...
|
7.3 High | — | 0,25% | 2 Okt 2026 |
|
CVE-2026-95102
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain u...
|
9.4 Critical | — | 0,34% | 2 Okt 2026 |
|
CVE-2026-94594
Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log...
|
4.0 Medium | — | 0,11% | 2 Okt 2026 |
|
CVE-2026-94593
Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credent...
|
7.8 High | — | 0,11% | 2 Okt 2026 |
|
CVE-2026-94592
Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a uniqu...
|
8.4 High | — | 0,13% | 2 Okt 2026 |
|
CVE-2026-94591
Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryp...
|
8.4 High | — | 0,09% | 2 Okt 2026 |