Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-89424
The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due to ins...
|
6.4 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-85235
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in...
|
7.2 High | — | 0,28% | 1 Okt 2026 |
|
CVE-2026-15983
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is...
|
8.1 High | — | 0,54% | 1 Okt 2026 |
|
CVE-2026-14995
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient...
|
7.2 High | — | 0,28% | 1 Okt 2026 |
|
CVE-2026-103664
MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed...
|
4.8 Medium | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-103662
MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).
The affected forms...
|
5.1 Medium | — | 0,34% | 1 Okt 2026 |
|
CVE-2026-103659
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object c...
|
7.1 High | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-103655
MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its tim...
|
9.3 Critical | — | 0,31% | 1 Okt 2026 |
|
CVE-2026-103431
colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a...
|
7.7 High | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-101925
The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admin/profile.php) + bbp_reply_content (via bbPress re...
|
6.4 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-100184
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scr...
|
4.7 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-100179
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scr...
|
6.1 Medium | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-93882
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and inc...
|
7.5 High | — | 0,36% | 1 Okt 2026 |
|
CVE-2026-89047
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3...
|
6.1 Medium | — | 0,29% | 1 Okt 2026 |
|
CVE-2026-78249
A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567...
|
6.8 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-75957
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0...
|
9.8 Critical | — | 0,58% | 1 Okt 2026 |
|
CVE-2026-19902
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and includin...
|
6.1 Medium | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-19807
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the `...
|
8.8 High | — | 0,38% | 1 Okt 2026 |
|
CVE-2026-15989
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Re...
|
9.8 Critical | — | 0,29% | 1 Okt 2026 |
|
CVE-2026-103651
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter....
|
7.6 High | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103544
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_cl...
|
6.3 Medium | — | 0,23% | 1 Okt 2026 |
|
CVE-2025-41753
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the int...
|
9.8 Critical | — | 0,59% | 1 Okt 2026 |
|
CVE-2026-96255
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment ga...
|
7.5 High | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-96200
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing...
|
5.3 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-96173
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback reque...
|
5.3 Medium | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-92412
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthentic...
|
7.1 High | — | 0,16% | 1 Okt 2026 |
|
CVE-2026-90974
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated u...
|
6.5 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-90972
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read ot...
|
5.4 Medium | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-89296
The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perfor...
|
8.6 High | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-88999
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifyi...
|
4.3 Medium | — | 0,33% | 1 Okt 2026 |
|
CVE-2026-87973
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing...
|
3.1 Low | — | 0,12% | 1 Okt 2026 |
|
CVE-2026-87970
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served...
|
4.7 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-86610
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow use...
|
6.4 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-85679
The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insu...
|
7.2 High | — | 0,31% | 1 Okt 2026 |
|
CVE-2026-81809
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity c...
|
7.5 High | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-81739
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the...
|
7.5 High | — | 0,22% | 1 Okt 2026 |
|
CVE-2026-80276
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authenti...
|
7.5 High | — | 0,37% | 1 Okt 2026 |
|
CVE-2026-80275
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change...
|
8.8 High | — | 0,25% | 1 Okt 2026 |
|
CVE-2026-67075
HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Ap...
|
6.5 Medium | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-19253
The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the r...
|
8.7 High | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-103543
A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such...
|
6.3 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103542
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the component AJAX Endpoint. Th...
|
4.3 Medium | — | 0,22% | 1 Okt 2026 |
|
CVE-2026-103541
A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the compone...
|
6.3 Medium | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-103540
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file g...
|
6.3 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-101148
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows...
|
10.0 Critical | — | 0,31% | 1 Okt 2026 |
|
CVE-2026-101147
The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST A...
|
8.8 High | — | 0,13% | 1 Okt 2026 |
|
CVE-2026-92966
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions u...
|
9.1 Critical | — | 0,45% | 1 Okt 2026 |
|
CVE-2026-92548
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This ma...
|
5.3 Medium | — | 0,32% | 1 Okt 2026 |
|
CVE-2026-82829
Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hi...
|
9.8 Critical | — | 0,29% | 1 Okt 2026 |
|
CVE-2026-82828
Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations.
This issue a...
|
8.8 High | — | 0,23% | 1 Okt 2026 |