Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-103258
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows...
|
6.8 Medium | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-103257
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resour...
|
7.7 High | — | 0,43% | 1 Okt 2026 |
|
CVE-2026-103256
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencry...
|
7.1 High | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-103255
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parame...
|
9.0 Critical | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-103254
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-...
|
6.3 Medium | — | 0,28% | 1 Okt 2026 |
|
CVE-2026-103253
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Dr...
|
8.7 High | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-103252
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that r...
|
7.7 High | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-103251
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation hand...
|
7.1 High | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103250
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails t...
|
8.1 High | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103249
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator paramete...
|
7.6 High | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-103248
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mod...
|
9.0 Critical | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-103247
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor acce...
|
8.5 High | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-103246
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary c...
|
7.7 High | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-103245
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook hand...
|
5.3 Medium | — | 0,16% | 1 Okt 2026 |
|
CVE-2026-103244
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrar...
|
9.8 Critical | — | 0,57% | 1 Okt 2026 |
|
CVE-2026-103082
Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affec...
|
7.2 High | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-96577
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead...
|
7.1 High | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-96256
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's...
|
6.4 Medium | — | 0,29% | 1 Okt 2026 |
|
CVE-2026-92144
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Pa...
|
7.2 High | — | 0,55% | 1 Okt 2026 |
|
CVE-2026-83589
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can...
|
6.1 Medium | — | 0,25% | 1 Okt 2026 |
|
CVE-2026-7176
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms ass...
|
4.8 Medium | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-75786
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.
|
7.2 High | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-7175
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript cod...
|
4.8 Medium | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-7174
CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wi...
|
4.8 Medium | — | 0,29% | 1 Okt 2026 |
|
CVE-2026-7173
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially cra...
|
4.8 Medium | — | 0,28% | 1 Okt 2026 |
|
CVE-2026-64950
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Aff...
|
8.4 High | — | 0,25% | 1 Okt 2026 |
|
CVE-2026-64949
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
|
8.6 High | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-64948
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
|
7.1 High | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-64947
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remo...
|
7.5 High | — | 0,25% | 1 Okt 2026 |
|
CVE-2026-64946
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and admi...
|
7.4 High | — | 0,16% | 1 Okt 2026 |
|
CVE-2026-34190
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrato...
|
5.9 Medium | — | 0,15% | 1 Okt 2026 |
|
CVE-2026-34189
Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a mali...
|
5.9 Medium | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-103497
jetbrains youtrack
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
|
5.5 Medium | — | 0,15% | 1 Okt 2026 |
|
CVE-2026-103496
jetbrains youtrack
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
|
5.4 Medium | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-103495
jetbrains youtrack
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
|
4.3 Medium | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-103494
jetbrains youtrack
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
|
6.6 Medium | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-103493
jetbrains youtrack
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
|
8.1 High | — | 0,22% | 1 Okt 2026 |
|
CVE-2026-103492
jetbrains youtrack
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
|
6.5 Medium | — | 0,68% | 1 Okt 2026 |
|
CVE-2026-103491
jetbrains youtrack
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
|
6.5 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103490
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
|
7.2 High | — | 0,43% | 1 Okt 2026 |
|
CVE-2026-103489
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
|
2.0 Low | — | 0,34% | 1 Okt 2026 |
|
CVE-2026-103488
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
|
7.1 High | — | 0,28% | 1 Okt 2026 |
|
CVE-2026-97661
The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including...
|
7.2 High | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-96813
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Lat...
|
7.2 High | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-96573
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedul...
|
7.2 High | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-96268
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions...
|
6.4 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-95687
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 Thi...
|
8.8 High | — | 0,48% | 1 Okt 2026 |
|
CVE-2026-92244
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in...
|
7.2 High | — | 0,28% | 1 Okt 2026 |
|
CVE-2026-90992
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and inclu...
|
6.4 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-89427
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and includ...
|
6.1 Medium | — | 0,25% | 1 Okt 2026 |