Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-82380
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority...
|
8.1 High | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-82379
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim'...
|
7.7 High | — | 0,37% | 28 Sep 2026 |
|
CVE-2026-82378
Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token...
|
9.0 Critical | — | 0,42% | 28 Sep 2026 |
|
CVE-2026-82377
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC...
|
9.9 Critical | — | 0,53% | 28 Sep 2026 |
|
CVE-2026-82376
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-...
|
7.7 High | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-82375
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-c...
|
7.4 High | — | 0,37% | 28 Sep 2026 |
|
CVE-2026-82348
Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resour...
|
7.7 High | — | 0,37% | 28 Sep 2026 |
|
CVE-2026-101013
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of t...
|
7.3 High | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-101012
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file mak...
|
7.3 High | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-101011
A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain/domainMod....
|
4.7 Medium | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-101010
A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation o...
|
4.7 Medium | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-93000
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing un...
|
6.8 Medium | — | 0,22% | 28 Sep 2026 |
|
CVE-2026-92996
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, all...
|
5.3 Medium | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-89411
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated u...
|
5.3 Medium | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-89303
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to p...
|
6.4 Medium | — | 0,15% | 28 Sep 2026 |
|
CVE-2026-89300
The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data...
|
5.3 Medium | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-88828
The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an acco...
|
5.4 Medium | — | 0,17% | 28 Sep 2026 |
|
CVE-2026-86838
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthent...
|
5.3 Medium | — | 0,22% | 28 Sep 2026 |
|
CVE-2026-84744
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form,...
|
6.5 Medium | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-101009
A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask....
|
8.4 High | — | 1,8% | 28 Sep 2026 |
|
CVE-2026-101008
A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merg...
|
9.1 Critical | — | 2,3% | 28 Sep 2026 |
|
CVE-2026-101007
A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Hand...
|
8.4 High | — | 1,8% | 28 Sep 2026 |
|
CVE-2026-101006
A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/a...
|
4.3 Medium | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-101005
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component...
|
7.3 High | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-100751
Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url opt...
|
7.5 High | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-100750
Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arb...
|
8.5 High | — | 0,23% | 28 Sep 2026 |
|
CVE-2026-101004
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of...
|
5.3 Medium | — | 0,50% | 28 Sep 2026 |
|
CVE-2026-101003
A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the comp...
|
5.3 Medium | — | 0,46% | 28 Sep 2026 |
|
CVE-2026-101002
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping...
|
9.9 Critical | — | 1,7% | 28 Sep 2026 |
|
CVE-2026-87723
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory...
|
5.4 Medium | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-101001
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Managemen...
|
10.0 Critical | — | 2,6% | 28 Sep 2026 |
|
CVE-2026-101000
A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the co...
|
10.0 Critical | — | 0,50% | 28 Sep 2026 |
|
CVE-2026-100909
A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeIm...
|
7.3 High | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-100908
A vulnerability has been found in Eyeplus 57.0.0.0308. This affects an unknown function of the component p2pcam HTTP Parser. Such manipulation leads to stack-based buffer...
|
7.5 High | — | 0,80% | 28 Sep 2026 |
|
CVE-2026-100907
A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the file /snapshot of the component p2pcam Service. This manipulation causes...
|
5.3 Medium | — | 0,29% | 28 Sep 2026 |
|
CVE-2026-100906
A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation resu...
|
5.3 Medium | — | 0,29% | 28 Sep 2026 |
|
CVE-2026-100904
A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown...
|
3.5 Low | — | 0,19% | 28 Sep 2026 |
|
CVE-2026-100903
A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such...
|
5.3 Medium | — | 0,46% | 28 Sep 2026 |
|
CVE-2026-100902
A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the comp...
|
6.5 Medium | — | 0,33% | 28 Sep 2026 |
|
CVE-2026-100901
A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulat...
|
7.3 High | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-100900
A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function updateJiraProjects of the file /jira-impor...
|
5.5 Medium | — | 0,16% | 28 Sep 2026 |
|
CVE-2026-100899
A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This impacts the function whereRaw of the file app/Filament/Widgets/Timeshee...
|
6.3 Medium | — | 0,19% | 28 Sep 2026 |
|
CVE-2026-100898
A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament/Widgets/Ti...
|
6.3 Medium | — | 0,19% | 28 Sep 2026 |
|
CVE-2026-100897
A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impacted element is an unknown function of the file /S...
|
5.5 Medium | — | 0,16% | 28 Sep 2026 |
|
CVE-2026-100896
A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web M...
|
9.9 Critical | — | 1,9% | 28 Sep 2026 |
|
CVE-2026-100895
A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_parse_canon_t in the library libopenarc/arc-canon.c...
|
5.3 Medium | — | 0,67% | 28 Sep 2026 |
|
CVE-2026-100894
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of th...
|
6.3 Medium | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-100893
A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_graph::fetch of the file src/api/resource.rs of the c...
|
7.3 High | — | 0,45% | 28 Sep 2026 |
|
CVE-2026-100892
A vulnerability was found in aligungr UERANSIM up to 3.3.0. This affects the function ULInformationTransfer of the file src/gnb/rrc/handler.cpp of the component nr-gnb. P...
|
5.3 Medium | — | 0,61% | 28 Sep 2026 |
|
CVE-2026-100891
A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function opendmarc_policy_query_dmarc in the library libopen...
|
7.3 High | — | 0,29% | 28 Sep 2026 |