Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-96814
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-96450
Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
|
5.4 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-96352
Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-96351
Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-96350
Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.
|
9.8 Critical | — | 0,45% | 30 Sep 2026 |
|
CVE-2026-96349
Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
|
10.0 Critical | — | 0,60% | 30 Sep 2026 |
|
CVE-2026-96348
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
|
7.5 High | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-96347
Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.
|
6.5 Medium | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-96346
Author SQL Injection in WP ERP <= 1.17.9 versions.
|
7.6 High | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-96345
Administrator SQL Injection in Estatik <= 4.3.5 versions.
|
7.6 High | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-96344
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
|
7.2 High | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-96343
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
|
7.2 High | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-96338
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
|
6.5 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-95616
apache wss4j
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certif...
|
7.5 High | — | 0,41% | 30 Sep 2026 |
|
CVE-2026-95587
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
|
7.5 High | — | 0,29% | 30 Sep 2026 |
|
CVE-2026-95531
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
|
8.8 High | — | 0,48% | 30 Sep 2026 |
|
CVE-2026-94683
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
|
8.8 High | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-94681
Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.
|
5.9 Medium | — | 0,30% | 30 Sep 2026 |
|
CVE-2026-94678
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
|
8.8 High | — | 0,38% | 30 Sep 2026 |
|
CVE-2026-94677
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
|
7.2 High | — | 0,40% | 30 Sep 2026 |
|
CVE-2026-94674
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
|
6.5 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-94673
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
|
5.3 Medium | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-94672
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
|
4.3 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-94499
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
|
7.1 High | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-94389
Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.
|
9.0 Critical | — | 0,46% | 30 Sep 2026 |
|
CVE-2026-94178
Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
|
7.5 High | — | 0,30% | 30 Sep 2026 |
|
CVE-2026-94177
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This iss...
|
8.5 High | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-94173
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
|
5.4 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-94123
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
|
7.5 High | — | 0,40% | 30 Sep 2026 |
|
CVE-2026-94122
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
|
7.2 High | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-94121
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
|
8.8 High | — | 0,38% | 30 Sep 2026 |
|
CVE-2026-94120
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
|
7.5 High | — | 0,29% | 30 Sep 2026 |
|
CVE-2026-94115
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
|
8.5 High | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-94082
Author SQL Injection in Quiz Cat <= 3.1.1 versions.
|
7.6 High | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-94081
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-94078
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
|
7.1 High | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-94077
Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
|
6.5 Medium | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-94076
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
|
8.8 High | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-94074
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
|
6.5 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-93771
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
|
7.2 High | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-93770
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
|
7.1 High | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-93651
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
|
7.2 High | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-93624
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
|
7.2 High | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-93621
Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
|
8.2 High | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-93514
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-93512
Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-92899
apache wss4j
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decode...
|
4.8 Medium | — | 0,51% | 30 Sep 2026 |
|
CVE-2026-92121
apache wss4j
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-Secu...
|
7.5 High | — | 0,55% | 30 Sep 2026 |
|
CVE-2026-89238
apache wss4j
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and po...
|
9.1 Critical | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-86778
Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting.
This issue aff...
|
5.3 Medium | — | 0,24% | 30 Sep 2026 |