Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-97251
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.
|
6.5 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-95588
Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.
|
8.6 High | — | 0,35% | 1 Okt 2026 |
|
CVE-2026-94390
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
|
7.2 High | — | 0,37% | 1 Okt 2026 |
|
CVE-2026-79900
boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name bu...
|
6.5 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-79899
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restricti...
|
7.9 High | — | 0,07% | 1 Okt 2026 |
|
CVE-2026-79898
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or th...
|
9.1 Critical | — | 0,98% | 1 Okt 2026 |
|
CVE-2026-67106
hcltech bigfix service management
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enabl...
|
5.3 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-67105
hcltech bigfix service management
HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted...
|
7.4 High | — | 0,16% | 1 Okt 2026 |
|
CVE-2026-67104
hcltech bigfix service management
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScr...
|
5.3 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-62073
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
|
7.5 High | — | 0,25% | 1 Okt 2026 |
|
CVE-2026-62071
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.
|
9.3 Critical | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-56599
hcltech bigfix service management
HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attribute...
|
2.2 Low | — | 0,06% | 1 Okt 2026 |
|
CVE-2026-56589
hcltech bigfix service management
HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within...
|
7.2 High | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103752
Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.
|
9.8 Critical | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-103687
A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sani...
|
7.3 High | — | 0,54% | 1 Okt 2026 |
|
CVE-2026-103347
Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.
|
5.3 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-103068
Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions.
|
8.8 High | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-103004
vercel next.js
Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache...
|
5.3 Medium | — | 0,25% | 1 Okt 2026 |
|
CVE-2026-102378
Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.
|
7.1 High | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-100517
Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.
|
7.5 High | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-100514
Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.
|
7.5 High | — | 0,29% | 1 Okt 2026 |
|
CVE-2024-58388
Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary file...
|
7.5 High | — | 0,82% | 1 Okt 2026 |
|
CVE-2026-79901
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random seque...
|
9.9 Critical | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-66253
iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access...
|
3.1 Low | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-66249
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabli...
|
3.1 Low | — | 0,10% | 1 Okt 2026 |
|
CVE-2026-66248
iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling th...
|
3.1 Low | — | 0,16% | 1 Okt 2026 |
|
CVE-2026-66247
iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with...
|
4.3 Medium | — | 0,22% | 1 Okt 2026 |
|
CVE-2026-66246
iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references...
|
8.8 High | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-103686
A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL...
|
3.5 Low | — | 0,37% | 1 Okt 2026 |
|
CVE-2026-102505
tonycoz imager
Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp.
For a paletted image, getsamples() with type "f...
|
6.3 Medium | — | 0,25% | 1 Okt 2026 |
|
CVE-2026-102504
tonycoz imager
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol.
Nothing range-checks raw_datach...
|
7.5 High | — | 0,39% | 1 Okt 2026 |
|
CVE-2026-62063
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue...
|
5.4 Medium | — | 0,17% | 1 Okt 2026 |
|
CVE-2026-62061
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Con...
|
5.3 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-62060
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL I...
|
7.6 High | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-62059
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Inj...
|
7.6 High | — | 0,28% | 1 Okt 2026 |
|
CVE-2026-62058
Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects C...
|
5.3 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103345
Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie...
|
5.3 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103343
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issu...
|
6.5 Medium | — | 0,13% | 1 Okt 2026 |
|
CVE-2026-103341
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Explo...
|
5.3 Medium | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-103340
Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Si...
|
5.3 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-103339
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XSS.This issue affects Metform:...
|
6.5 Medium | — | 0,13% | 1 Okt 2026 |
|
CVE-2026-103338
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, A...
|
8.5 High | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-103067
Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - M...
|
8.0 High | — | 0,12% | 1 Okt 2026 |
|
CVE-2026-103064
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stor...
|
6.5 Medium | — | 0,13% | 1 Okt 2026 |
|
CVE-2026-103063
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stor...
|
6.5 Medium | — | 0,13% | 1 Okt 2026 |
|
CVE-2026-102394
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elem...
|
6.5 Medium | — | 0,13% | 1 Okt 2026 |
|
CVE-2026-102390
Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Acc...
|
5.3 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-102382
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security...
|
4.3 Medium | — | 0,17% | 1 Okt 2026 |
|
CVE-2026-102381
Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects...
|
5.3 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-102379
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Bu...
|
8.5 High | — | 0,21% | 1 Okt 2026 |