Katalog CVE

Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.

TLP:CLEAR

csirt@kutim:~/threat-intel/cve
$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.403 (Critical 35.986 · High 103.717 · KEV 1.747 · sejak 2020)  ·  Pembaruan terakhir: 18 Okt 2026, 12:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 9.151–9.200 dari 259.403 CVE.

CVE Severity KEV EPSS Terbit
CVE-2026-97262
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
 6.5 Medium — 0,13% 30 Sep 2026
CVE-2026-97261
Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.
 5.3 Medium — 0,20% 30 Sep 2026
CVE-2026-97253
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects Layer...
 7.1 High — 0,15% 30 Sep 2026
CVE-2026-97250
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
 7.1 High — 0,15% 30 Sep 2026
CVE-2026-97249
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
 5.3 Medium — 0,20% 30 Sep 2026
CVE-2026-97248
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
 9.8 Critical — 0,39% 30 Sep 2026
CVE-2026-97247
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
 6.5 Medium — 0,21% 30 Sep 2026
CVE-2026-97246
Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.
 4.9 Medium — 0,21% 30 Sep 2026
CVE-2026-97245
Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.
 7.2 High — 0,34% 30 Sep 2026
CVE-2026-97244
Contributor Path Traversal in Creator LMS <= 1.2.19 versions.
 7.5 High — 0,30% 30 Sep 2026
CVE-2026-97243
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
 5.4 Medium — 0,22% 30 Sep 2026
CVE-2026-97242
Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.
 6.8 Medium — 0,36% 30 Sep 2026
CVE-2026-97241
Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.
 7.5 High — 0,30% 30 Sep 2026
CVE-2026-97240
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.
 7.5 High — 0,30% 30 Sep 2026
CVE-2026-97239
Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.
 6.5 Medium — 0,28% 30 Sep 2026
CVE-2026-97238
Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
 5.5 Medium — 0,17% 30 Sep 2026
CVE-2026-97237
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
 7.1 High — 0,18% 30 Sep 2026
CVE-2026-97236
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
 6.5 Medium — 0,21% 30 Sep 2026
CVE-2026-97235
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
 7.1 High — 0,18% 30 Sep 2026
CVE-2026-97197
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
 7.5 High — 0,29% 30 Sep 2026
CVE-2026-97079
Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.
 4.3 Medium — 0,28% 30 Sep 2026
CVE-2026-97078
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
 5.3 Medium — 0,23% 30 Sep 2026
CVE-2026-97077
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.
 7.1 High — 0,20% 30 Sep 2026
CVE-2026-97074
Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.
 4.3 Medium — 0,25% 30 Sep 2026
CVE-2026-97067
Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.
 6.5 Medium — 0,18% 30 Sep 2026
CVE-2026-97066
Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
 5.3 Medium — 0,23% 30 Sep 2026
CVE-2026-97065
Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.
 7.1 High — 0,18% 30 Sep 2026
CVE-2026-96838
Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification <= 2.3.1 versions.
 8.8 High — 0,14% 30 Sep 2026
CVE-2026-96837
Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.
 8.8 High — 0,54% 30 Sep 2026
CVE-2026-96836
Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.
 7.1 High — 0,20% 30 Sep 2026
CVE-2026-96835
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.
 6.5 Medium — 0,16% 30 Sep 2026
CVE-2026-96834
Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.
 6.5 Medium — 0,33% 30 Sep 2026
CVE-2026-96833
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
 7.2 High — 0,40% 30 Sep 2026
CVE-2026-96832
Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.
 7.2 High — 0,37% 30 Sep 2026
CVE-2026-96831
Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
 8.8 High — 0,36% 30 Sep 2026
CVE-2026-96830
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
 7.1 High — 0,20% 30 Sep 2026
CVE-2026-96829
Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.
 6.5 Medium — 0,18% 30 Sep 2026
CVE-2026-96828
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
 7.6 High — 0,28% 30 Sep 2026
CVE-2026-96827
Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
 7.6 High — 0,28% 30 Sep 2026
CVE-2026-96825
Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.
 4.2 Medium — 0,20% 30 Sep 2026
CVE-2026-96824
Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.
 6.8 Medium — 0,39% 30 Sep 2026
CVE-2026-96823
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
 7.5 High — 0,32% 30 Sep 2026
CVE-2026-96822
Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
 9.3 Critical — 0,29% 30 Sep 2026
CVE-2026-96821
Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.
 6.3 Medium — 0,25% 30 Sep 2026
CVE-2026-96820
Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.
 7.1 High — 0,24% 30 Sep 2026
CVE-2026-96819
Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.
 7.1 High — 0,24% 30 Sep 2026
CVE-2026-96818
Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.
 7.5 High — 0,25% 30 Sep 2026
CVE-2026-96817
Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.
 8.2 High — 0,37% 30 Sep 2026
CVE-2026-96816
Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.
 7.1 High — 0,18% 30 Sep 2026
CVE-2026-96815
Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.
 7.2 High — 0,32% 30 Sep 2026
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.