Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-102565
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in all versions up to, and including, 1.8...
|
7.2 High | — | 0,31% | 2 Okt 2026 |
|
CVE-2026-97318
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting...
|
6.1 Medium | — | 0,15% | 2 Okt 2026 |
|
CVE-2026-97317
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveawa...
|
5.3 Medium | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-94298
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL...
|
6.2 Medium | — | 0,21% | 2 Okt 2026 |
|
CVE-2026-92820
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (Amazon S3) u...
|
8.1 High | — | 0,52% | 2 Okt 2026 |
|
CVE-2026-92174
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter....
|
7.5 High | — | 0,57% | 2 Okt 2026 |
|
CVE-2026-91828
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slo...
|
7.5 High | — | 0,31% | 2 Okt 2026 |
|
CVE-2026-91023
The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions...
|
3.1 Low | — | 0,13% | 2 Okt 2026 |
|
CVE-2026-91022
The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a cust...
|
6.8 Medium | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-90988
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to...
|
5.3 Medium | — | 0,21% | 2 Okt 2026 |
|
CVE-2026-90438
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission...
|
7.2 High | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-85016
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-para...
|
6.8 Medium | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-85004
The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticat...
|
4.3 Medium | — | 0,15% | 2 Okt 2026 |
|
CVE-2026-84925
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to...
|
6.1 Medium | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-81740
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not b...
|
5.3 Medium | — | 0,18% | 2 Okt 2026 |
|
CVE-2026-78471
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficie...
|
5.4 Medium | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-15897
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Re...
|
8.8 High | — | 0,30% | 2 Okt 2026 |
|
CVE-2026-15896
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request f...
|
9.1 Critical | — | 0,88% | 2 Okt 2026 |
|
CVE-2026-13718
The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to st...
|
6.8 Medium | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-19660
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooke...
|
9.8 Critical | — | 0,40% | 2 Okt 2026 |
|
CVE-2026-10026
The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'F...
|
7.2 High | — | 0,32% | 2 Okt 2026 |
|
CVE-2026-93367
The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.2...
|
7.2 High | — | 0,19% | 2 Okt 2026 |
|
CVE-2026-14378
The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is d...
|
9.8 Critical | — | 0,48% | 2 Okt 2026 |
|
CVE-2026-104123
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/a...
|
7.3 High | — | 0,33% | 2 Okt 2026 |
|
CVE-2026-104120
A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetch_url of the fi...
|
7.3 High | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-21140
Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.
|
6.9 Medium | — | 0,11% | 2 Okt 2026 |
|
CVE-2026-104480
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DA...
|
9.4 Critical | — | 0,40% | 2 Okt 2026 |
|
CVE-2026-104054
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the comp...
|
6.3 Medium | — | 0,21% | 2 Okt 2026 |
|
CVE-2026-104053
A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin_reservefilter.php. Such manip...
|
6.3 Medium | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-104052
A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file admin_reject_completed.php. This ma...
|
6.3 Medium | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-103098
Transmission of a sensitive key in the URL
over an unencrypted HTTP connection. The
request is sent over HTTP rather than HTTPS, meaning the key is transmitted in
plaint...
|
7.5 High | — | 0,16% | 2 Okt 2026 |
|
CVE-2026-103097
An API key is
hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly i...
|
7.5 High | — | 0,15% | 2 Okt 2026 |
|
CVE-2026-103096
API
key is hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly in t...
|
7.5 High | — | 0,15% | 2 Okt 2026 |
|
CVE-2026-86345
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path atta...
|
9.0 Critical | — | 0,38% | 2 Okt 2026 |
|
CVE-2026-103766
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete pa...
|
7.2 High | — | 0,37% | 2 Okt 2026 |
|
CVE-2026-103765
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read,...
|
9.4 Critical | — | 0,50% | 2 Okt 2026 |
|
CVE-2026-103764
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbi...
|
9.8 Critical | — | 0,64% | 2 Okt 2026 |
|
CVE-2026-103761
Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to g...
|
7.5 High | — | 0,37% | 1 Okt 2026 |
|
CVE-2026-103760
Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by nev...
|
5.9 Medium | — | 0,40% | 1 Okt 2026 |
|
CVE-2025-71427
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supply...
|
6.8 Medium | — | 0,29% | 1 Okt 2026 |
|
CVE-2026-86344
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the sam...
|
7.5 High | — | 0,35% | 1 Okt 2026 |
|
CVE-2026-71454
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting (...
|
5.8 Medium | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-71453
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack.
This issue affects EasyIO FS32: before 3.0b63.
|
5.6 Medium | — | 0,12% | 1 Okt 2026 |
|
CVE-2026-71452
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection.
This issue affects EasyIO FS32: before 3.0b63.
|
7.2 High | — | 0,68% | 1 Okt 2026 |
|
CVE-2026-51897
RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code...
|
9.8 Critical | — | 0,73% | 1 Okt 2026 |
|
CVE-2026-51896
infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unauthorized cro...
|
6.5 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-71449
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data.
This issue affects EasyIO FS32: before 3.0...
|
9.3 Critical | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-71448
: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse.
This issue affects EasyIO FS32: before 3.0b63.
|
5.6 Medium | — | 0,15% | 1 Okt 2026 |
|
CVE-2026-64893
- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack.
This issue affects EasyIO NEO: before 3...
|
7.3 High | — | 0,12% | 1 Okt 2026 |
|
CVE-2026-64892
- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations.
This issue affects Easy IO Neo: bef...
|
6.3 Medium | — | 0,24% | 1 Okt 2026 |