Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-85483
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings.
This issue affects Apache Thrift: before 0.25.0.
Users ar...
|
6.3 Medium | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-59668
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-59667
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-59666
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-104606
A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipula...
|
6.3 Medium | — | 0,25% | 2 Okt 2026 |
|
CVE-2026-97652
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Param...
|
6.1 Medium | — | 0,26% | 2 Okt 2026 |
|
CVE-2026-95662
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-94639
improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings.
Thi...
|
8.2 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-94635
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
This issue affec...
|
8.7 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-94634
Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings.
This issue...
|
8.2 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-94541
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the p...
|
9.8 Critical | — | 0,49% | 2 Okt 2026 |
|
CVE-2026-94405
Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data.
This issue affects Download Manager:...
|
5.3 Medium | — | 0,33% | 2 Okt 2026 |
|
CVE-2026-94180
Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data.
This issue affects Advanced Ads: fro...
|
4.3 Medium | — | 0,28% | 2 Okt 2026 |
|
CVE-2026-87920
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and includ...
|
7.2 High | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-85492
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to DOM-Based Cross-Site...
|
6.1 Medium | — | 0,21% | 2 Okt 2026 |
|
CVE-2026-80298
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection.
This...
|
8.8 High | — | 0,30% | 2 Okt 2026 |
|
CVE-2026-59673
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,38% | 2 Okt 2026 |
|
CVE-2026-59672
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,38% | 2 Okt 2026 |
|
CVE-2026-59665
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-59664
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-59663
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-59662
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-59661
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-59660
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-59659
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-103885
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinite...
|
7.5 High | — | 0,49% | 2 Okt 2026 |
|
CVE-2026-103877
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.
A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subs...
|
9.8 Critical | — | 0,57% | 2 Okt 2026 |
|
CVE-2026-103880
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API.
Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server th...
|
7.5 High | — | 0,49% | 2 Okt 2026 |
|
CVE-2026-103878
Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API.
A StartTLS extended operation started after a Search request has been sent...
|
7.5 High | — | 0,21% | 2 Okt 2026 |
|
CVE-2026-104403
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels.
This issu...
|
5.3 Medium | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-103552
Stack Overflow vulnerability in Apache Directory LDAP API.
Before binding, a client can send a deeply nested search filter that overflows the stack in the server's dec...
|
7.3 High | — | 0,34% | 2 Okt 2026 |
|
CVE-2026-102731
Memory allocation with excessive size value vulnerability in Apache Directory LDAP API.
A malicious peer (or a MITM) can send a small BER-encoded response causing a la...
|
7.5 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-95512
A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that emb...
|
5.5 Medium | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-91784
cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local...
|
4.8 Medium | — | 0,15% | 2 Okt 2026 |
|
CVE-2026-80464
Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery.
This issue affects Sef - AI Chatbot Platf...
|
4.9 Medium | — | 0,27% | 2 Okt 2026 |
|
CVE-2026-80443
Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM).
This issue affects Sef - AI Chatbot Platf...
|
7.4 High | — | 0,16% | 2 Okt 2026 |
|
CVE-2026-80337
Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Sef -...
|
5.3 Medium | — | 0,21% | 2 Okt 2026 |
|
CVE-2026-59671
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-59670
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-59669
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitr...
|
4.8 Medium | — | 0,32% | 2 Okt 2026 |
|
CVE-2026-97663
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122...
|
7.2 High | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-97641
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to...
|
7.2 High | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-97637
The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulner...
|
9.8 Critical | — | 0,64% | 2 Okt 2026 |
|
CVE-2026-97634
The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 du...
|
6.5 Medium | — | 0,28% | 2 Okt 2026 |
|
CVE-2026-97342
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in...
|
7.2 High | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-97338
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient i...
|
6.4 Medium | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-97336
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient inp...
|
7.2 High | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-96871
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.2 due to insuffic...
|
7.2 High | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-96647
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[remark]' Parameter in...
|
6.4 Medium | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-96578
The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and includi...
|
7.2 High | — | 0,25% | 2 Okt 2026 |