Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-96567
The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 5.1.7 due to insufficie...
|
7.2 High | — | 0,26% | 2 Okt 2026 |
|
CVE-2026-96566
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up...
|
7.2 High | — | 0,27% | 2 Okt 2026 |
|
CVE-2026-95817
The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insuffi...
|
7.2 High | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-95670
The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2....
|
7.2 High | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-94432
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to,...
|
5.3 Medium | — | 0,27% | 2 Okt 2026 |
|
CVE-2026-93880
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions...
|
6.1 Medium | — | 0,21% | 2 Okt 2026 |
|
CVE-2026-93756
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via...
|
7.2 High | — | 0,27% | 2 Okt 2026 |
|
CVE-2026-63578
Allocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy Castle Inc. bc-csharp befo...
|
7.1 High | — | 0,33% | 2 Okt 2026 |
|
CVE-2026-63577
Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValidator.WithinDNSubtree) in Legion of the Bouncy Castle Inc. bc-csharp bef...
|
8.2 High | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-63576
Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained s...
|
8.2 High | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-63575
Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attack...
|
7.1 High | — | 0,19% | 2 Okt 2026 |
|
CVE-2026-63574
Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket, UserAttributeSubpacketsPa...
|
8.7 High | — | 0,32% | 2 Okt 2026 |
|
CVE-2026-63573
Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0...
|
8.2 High | — | 0,31% | 2 Okt 2026 |
|
CVE-2026-63572
Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who ca...
|
7.1 High | — | 0,33% | 2 Okt 2026 |
|
CVE-2026-63571
Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder) in Legion o...
|
8.7 High | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-63570
Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a cra...
|
7.1 High | — | 0,21% | 2 Okt 2026 |
|
CVE-2026-18036
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so...
|
8.2 High | — | 0,28% | 2 Okt 2026 |
|
CVE-2026-17508
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed,...
|
5.3 Medium | — | 0,44% | 2 Okt 2026 |
|
CVE-2026-17507
bouncycastle bc-java
In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit...
|
7.5 High | — | 0,34% | 2 Okt 2026 |
|
CVE-2026-12951
The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endp...
|
6.5 Medium | — | 0,31% | 2 Okt 2026 |
|
CVE-2026-103604
Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Legion of the Bouncy Castle Inc. b...
|
8.7 High | — | 0,26% | 2 Okt 2026 |
|
CVE-2026-103603
Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7....
|
8.7 High | — | 0,41% | 2 Okt 2026 |
|
CVE-2026-103602
Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain c...
|
8.2 High | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-103601
Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allo...
|
8.2 High | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-103600
Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated...
|
8.7 High | — | 0,32% | 2 Okt 2026 |
|
CVE-2026-103426
The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and including, 2.31.4 due to insuf...
|
7.2 High | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-102772
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textarea_code field id> (e.g. kl_code, kl_post_code)' parameter in all versions up to...
|
7.2 High | — | 0,31% | 2 Okt 2026 |
|
CVE-2026-102002
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, a...
|
3.1 Low | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-100182
The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including,...
|
7.2 High | — | 0,31% | 2 Okt 2026 |
|
CVE-2026-100107
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to...
|
7.2 High | — | 0,31% | 2 Okt 2026 |
|
CVE-2026-97219
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable a...
|
4.3 Medium | — | 0,19% | 2 Okt 2026 |
|
CVE-2026-93698
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
|
9.9 Critical | — | 0,63% | 2 Okt 2026 |
|
CVE-2026-93697
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
|
9.0 Critical | — | 0,52% | 2 Okt 2026 |
|
CVE-2026-93029
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
|
9.0 Critical | — | 0,52% | 2 Okt 2026 |
|
CVE-2026-92924
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing u...
|
5.4 Medium | — | 0,18% | 2 Okt 2026 |
|
CVE-2026-91020
The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item pri...
|
5.3 Medium | — | 0,26% | 2 Okt 2026 |
|
CVE-2026-90987
The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unau...
|
5.3 Medium | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-90952
The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users t...
|
5.3 Medium | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-85005
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, a...
|
5.4 Medium | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-84740
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering c...
|
6.5 Medium | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-79618
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated us...
|
4.3 Medium | — | 0,19% | 2 Okt 2026 |
|
CVE-2026-63569
Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path...
|
9.1 Critical | — | 0,40% | 2 Okt 2026 |
|
CVE-2026-63568
Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0...
|
8.7 High | — | 0,32% | 2 Okt 2026 |
|
CVE-2026-63567
Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciph...
|
8.2 High | — | 0,47% | 2 Okt 2026 |
|
CVE-2026-63566
Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in Legion of the Bouncy Castle Inc. bc-csharp before...
|
8.7 High | — | 0,37% | 2 Okt 2026 |
|
CVE-2026-1661
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing u...
|
4.3 Medium | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-16001
Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngine constructed without a block cipher) in Legion of...
|
8.2 High | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-16000
Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who ca...
|
8.7 High | — | 0,25% | 2 Okt 2026 |
|
CVE-2026-15999
Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 a...
|
8.2 High | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-13413
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing...
|
5.3 Medium | — | 0,25% | 2 Okt 2026 |