Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-97196
Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass.
This issue affects GiveWP: from n/a throu...
|
9.1 Critical | — | 0,30% | 30 Sep 2026 |
|
CVE-2026-89294
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter...
|
7.5 High | — | 0,65% | 30 Sep 2026 |
|
CVE-2026-97316
The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypa...
|
5.8 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-96886
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address...
|
5.3 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-94297
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a ne...
|
2.7 Low | — | 0,17% | 30 Sep 2026 |
|
CVE-2026-94274
The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending mo...
|
5.3 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-93580
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP chec...
|
5.3 Medium | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-92994
The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them bac...
|
8.8 High | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-92424
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and s...
|
6.8 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-91832
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress...
|
7.1 High | — | 0,09% | 30 Sep 2026 |
|
CVE-2026-91072
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an a...
|
4.4 Medium | — | 0,17% | 30 Sep 2026 |
|
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta f...
|
6.6 Medium | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-90953
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to r...
|
4.3 Medium | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-89193
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image del...
|
7.5 High | — | 0,22% | 30 Sep 2026 |
|
CVE-2026-89190
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers,...
|
4.3 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-88797
The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowi...
|
7.1 High | — | 0,19% | 30 Sep 2026 |
|
CVE-2026-88791
The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured...
|
3.4 Low | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-87777
The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contribut...
|
6.8 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-86789
The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, a...
|
5.3 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-85576
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settin...
|
4.3 Medium | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-85573
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of...
|
8.8 High | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-85415
The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contri...
|
6.8 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-85001
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could a...
|
6.8 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-83560
The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured,...
|
5.3 Medium | — | 0,23% | 30 Sep 2026 |
|
CVE-2026-82127
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputt...
|
3.5 Low | — | 0,14% | 30 Sep 2026 |
|
CVE-2026-80333
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors...
|
5.3 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-75873
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users...
|
9.8 Critical | — | 0,57% | 30 Sep 2026 |
|
CVE-2026-75824
The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to c...
|
5.3 Medium | — | 0,22% | 30 Sep 2026 |
|
CVE-2026-75823
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register w...
|
7.4 High | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-100143
The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowin...
|
6.5 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-103111
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
|
7.6 High | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-102913
A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_enr...
|
7.3 High | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-86134
watchguard fireware
A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by...
|
7.5 High | — | 0,38% | 30 Sep 2026 |
|
CVE-2026-103110
pexip infinity
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged u...
|
9.8 Critical | — | 0,61% | 30 Sep 2026 |
|
CVE-2026-102912
A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The mani...
|
4.7 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-102911
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executi...
|
9.9 Critical | — | 1,8% | 30 Sep 2026 |
|
CVE-2026-102910
A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/as...
|
7.3 High | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-96649
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content...
|
7.2 High | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-86556
There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant informatio...
|
5.3 Medium | — | 0,19% | 30 Sep 2026 |
|
CVE-2026-103109
pexip infinity
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory...
|
9.4 Critical | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-103108
pexip infinity
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a sof...
|
7.5 High | — | 0,31% | 30 Sep 2026 |
|
CVE-2026-103106
pexip infinity
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with loc...
|
7.8 High | — | 0,14% | 30 Sep 2026 |
|
CVE-2026-103105
pexip infinity
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a nod...
|
8.8 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-103104
pexip infinity
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to trigger a sof...
|
7.5 High | — | 0,31% | 30 Sep 2026 |
|
CVE-2026-103102
pexip infinity
Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort resulting i...
|
8.6 High | — | 0,32% | 30 Sep 2026 |
|
CVE-2026-103101
pexip infinity
Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node i...
|
7.5 High | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-103100
pexip infinity
Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abort resulting...
|
7.5 High | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-103099
pexip infinity
Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a d...
|
7.5 High | — | 0,31% | 30 Sep 2026 |
|
CVE-2026-102909
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/exampro...
|
7.3 High | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-102908
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessme...
|
7.3 High | — | 0,26% | 30 Sep 2026 |