Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-103237
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-te...
|
8.3 High | — | 0,23% | 30 Sep 2026 |
|
CVE-2026-103235
MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application author...
|
8.7 High | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-97347
The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to in...
|
7.2 High | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-93908
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in...
|
6.4 Medium | — | 0,19% | 30 Sep 2026 |
|
CVE-2026-92712
The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and...
|
6.4 Medium | — | 0,19% | 30 Sep 2026 |
|
CVE-2026-75098
The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This mak...
|
7.5 High | — | 0,90% | 30 Sep 2026 |
|
CVE-2026-102588
moodle
A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade man...
|
6.5 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-102587
moodle
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filte...
|
2.7 Low | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-102586
moodle
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack...
|
6.1 Medium | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-102585
moodle
A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belon...
|
4.3 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-102584
moodle
A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the re...
|
4.3 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-102583
moodle
A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user...
|
2.7 Low | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-102582
moodle
A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment pe...
|
4.3 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-102581
moodle
A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker c...
|
5.4 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-102580
moodle
A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class ins...
|
4.3 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-102579
moodle
A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolle...
|
4.3 Medium | — | 0,23% | 30 Sep 2026 |
|
CVE-2026-102578
moodle
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting...
|
8.8 High | — | 0,30% | 30 Sep 2026 |
|
CVE-2026-102577
moodle
A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass...
|
4.3 Medium | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-102511
Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP data...
|
8.5 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-102510
Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC...
|
8.7 High | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-102509
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC4J) allow a...
|
8.7 High | — | 0,40% | 30 Sep 2026 |
|
CVE-2026-102459
EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's b...
|
6.1 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-102458
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a spec...
|
9.8 Critical | — | 0,43% | 30 Sep 2026 |
|
CVE-2026-102457
EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system fi...
|
6.5 Medium | — | 0,38% | 30 Sep 2026 |
|
CVE-2026-102456
EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.
|
6.5 Medium | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-102455
EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending mali...
|
9.8 Critical | — | 0,51% | 30 Sep 2026 |
|
CVE-2026-102454
EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling ar...
|
7.2 High | — | 0,56% | 30 Sep 2026 |
|
CVE-2025-14564
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to in...
|
6.4 Medium | — | 0,19% | 30 Sep 2026 |
|
CVE-2026-97150
When converting baserCMS4-style addons to baserCMS5-style ones,
BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed....
|
8.6 High | — | 0,34% | 30 Sep 2026 |
|
CVE-2026-93464
A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in...
|
5.1 Medium | — | 0,14% | 30 Sep 2026 |
|
CVE-2026-93463
A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user'...
|
5.1 Medium | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-93462
A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information.
|
6.9 Medium | — | 0,32% | 30 Sep 2026 |
|
CVE-2026-93460
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be e...
|
5.1 Medium | — | 0,14% | 30 Sep 2026 |
|
CVE-2026-92873
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the le...
|
6.9 Medium | — | 0,31% | 30 Sep 2026 |
|
CVE-2026-92872
Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.
|
5.3 Medium | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-92871
A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.
|
8.7 High | — | 0,29% | 30 Sep 2026 |
|
CVE-2026-92870
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.
|
8.7 High | — | 0,32% | 30 Sep 2026 |
|
CVE-2026-92869
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.
|
7.1 High | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-92868
An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.
|
6.9 Medium | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-92867
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.
|
8.7 High | — | 0,34% | 30 Sep 2026 |
|
CVE-2026-88037
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to,...
|
6.4 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-6806
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all v...
|
7.5 High | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-6173
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's bt_bb_section shortcode in al...
|
6.4 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-6172
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions...
|
6.4 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-6171
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_icon shortcode in all versions up...
|
6.4 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-6170
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all v...
|
6.4 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-16596
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to i...
|
6.5 Medium | — | 0,22% | 30 Sep 2026 |
|
CVE-2026-14876
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to i...
|
6.4 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-11895
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options'...
|
6.4 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-102508
Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position...
|
9.2 Critical | — | 0,13% | 30 Sep 2026 |