Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-100255
jetbrains teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 administrator account takeover was possible via password reset
|
9.8 Critical | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-100254
jetbrains teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection set...
|
8.8 High | — | 0,47% | 30 Sep 2026 |
|
CVE-2026-100253
jetbrains teamcity
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
|
8.8 High | — | 0,44% | 30 Sep 2026 |
|
CVE-2026-97259
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Sec...
|
5.3 Medium | — | 0,22% | 30 Sep 2026 |
|
CVE-2026-94545
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before includin...
|
5.3 Medium | — | 1,0% | 30 Sep 2026 |
|
CVE-2026-76570
Advisory
joomcode jc tables
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token...
|
9.1 Critical | — | 0,45% | 30 Sep 2026 |
|
CVE-2026-62097
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQ...
|
7.6 High | — | 0,23% | 30 Sep 2026 |
|
CVE-2026-62084
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS.
This issue affec...
|
6.5 Medium | — | 0,13% | 30 Sep 2026 |
|
CVE-2026-47097
AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exp...
|
7.5 High | — | 0,38% | 30 Sep 2026 |
|
CVE-2026-18783
Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass.
This issue affects Tre...
|
8.8 High | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-18782
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Comman...
|
9.8 Critical | — | 0,48% | 30 Sep 2026 |
|
CVE-2026-103398
OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside...
|
8.1 High | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-103397
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMe...
|
5.6 Medium | — | 0,22% | 30 Sep 2026 |
|
CVE-2026-103396
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches...
|
4.3 Medium | — | 0,29% | 30 Sep 2026 |
|
CVE-2026-103395
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remot...
|
9.8 Critical | — | 0,62% | 30 Sep 2026 |
|
CVE-2026-103389
MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side...
|
6.2 Medium | — | 0,30% | 30 Sep 2026 |
|
CVE-2026-103388
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_...
|
6.2 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-103270
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints lik...
|
7.5 High | — | 0,51% | 30 Sep 2026 |
|
CVE-2026-103243
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request for...
|
5.8 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-103227
A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the componen...
|
6.3 Medium | — | 0,52% | 30 Sep 2026 |
|
CVE-2026-103226
A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwri...
|
6.3 Medium | — | 0,52% | 30 Sep 2026 |
|
CVE-2026-103222
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompress...
|
5.6 Medium | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-102984
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make...
|
8.2 High | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-102983
Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-imag...
|
6.3 Medium | — | 0,31% | 30 Sep 2026 |
|
CVE-2026-102717
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
|
7.5 High | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-101295
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI...
|
7.3 High | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-93903
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
|
9.4 Critical | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-93547
A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comment...
|
5.3 Medium | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-91860
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a...
|
6.3 Medium | — | 0,47% | 30 Sep 2026 |
|
CVE-2026-82307
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection.
This is...
|
9.8 Critical | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-103118
A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WP...
|
4.3 Medium | — | 0,29% | 30 Sep 2026 |
|
CVE-2026-97302
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
|
5.3 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-97301
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
|
6.5 Medium | — | 0,17% | 30 Sep 2026 |
|
CVE-2026-97299
Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.
|
5.4 Medium | — | 0,10% | 30 Sep 2026 |
|
CVE-2026-97298
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
|
6.5 Medium | — | 0,13% | 30 Sep 2026 |
|
CVE-2026-97293
Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
|
8.5 High | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-97292
Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.
|
6.5 Medium | — | 0,13% | 30 Sep 2026 |
|
CVE-2026-97289
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based...
|
7.1 High | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-97288
Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.
|
6.5 Medium | — | 0,13% | 30 Sep 2026 |
|
CVE-2026-97287
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL...
|
8.5 High | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-97286
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.T...
|
6.5 Medium | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-97285
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
|
5.4 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-97282
Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.
|
5.3 Medium | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-97279
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
|
6.5 Medium | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-97274
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.
|
9.8 Critical | — | 0,30% | 30 Sep 2026 |
|
CVE-2026-97272
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.
|
7.1 High | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-97271
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
|
7.1 High | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-97270
Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.
|
6.5 Medium | — | 0,17% | 30 Sep 2026 |
|
CVE-2026-97267
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
|
4.3 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-97266
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
|
6.5 Medium | — | 0,13% | 30 Sep 2026 |