Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-88996
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting...
|
6.1 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-84280
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter in all versions up to, and i...
|
7.2 High | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-19804
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execut...
|
8.8 High | — | 1,0% | 25 Sep 2026 |
|
CVE-2026-17602
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the '...
|
4.9 Medium | — | 0,56% | 25 Sep 2026 |
|
CVE-2026-17577
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42. The ssl_z...
|
6.1 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-13456
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to,...
|
7.5 High | — | 0,75% | 25 Sep 2026 |
|
CVE-2026-13179
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_valu...
|
6.4 Medium | — | 0,33% | 25 Sep 2026 |
|
CVE-2026-12037
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'page_url' p...
|
5.5 Medium | — | 0,30% | 25 Sep 2026 |
|
CVE-2026-97846
Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to thei...
|
6.8 Medium | — | 0,14% | 25 Sep 2026 |
|
CVE-2026-96766
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hour...
|
6.4 Medium | — | 0,20% | 25 Sep 2026 |
|
CVE-2026-96039
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insu...
|
7.2 High | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-94376
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display...
|
6.4 Medium | — | 0,19% | 25 Sep 2026 |
|
CVE-2026-93899
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Para...
|
6.5 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-93897
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom F...
|
6.4 Medium | — | 0,22% | 25 Sep 2026 |
|
CVE-2026-93477
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argumen...
|
5.9 Medium | — | 0,20% | 25 Sep 2026 |
|
CVE-2026-93399
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_comp...
|
9.1 Critical | — | 0,37% | 25 Sep 2026 |
|
CVE-2026-93303
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field v...
|
7.2 High | — | 0,25% | 25 Sep 2026 |
|
CVE-2026-92829
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to...
|
4.3 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-92799
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and...
|
5.3 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-92746
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attrib...
|
6.4 Medium | — | 0,19% | 25 Sep 2026 |
|
CVE-2026-92212
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Cal...
|
6.1 Medium | — | 0,22% | 25 Sep 2026 |
|
CVE-2026-89055
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin n...
|
9.1 Critical | — | 0,39% | 25 Sep 2026 |
|
CVE-2026-84281
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions up to, and...
|
7.2 High | — | 0,21% | 25 Sep 2026 |
|
CVE-2026-84279
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2...
|
7.2 High | — | 0,19% | 25 Sep 2026 |
|
CVE-2026-83591
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions u...
|
7.2 High | — | 0,25% | 25 Sep 2026 |
|
CVE-2026-78397
The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request...
|
4.0 Medium | — | 0,16% | 25 Sep 2026 |
|
CVE-2026-78394
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Cont...
|
4.1 Medium | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-78393
The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end dir...
|
6.1 Medium | — | 0,15% | 25 Sep 2026 |
|
CVE-2026-75553
Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key f...
|
2.4 Low | — | 0,14% | 25 Sep 2026 |
|
CVE-2026-62062
Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery.
This issue affects Elementor Website Builder: from n/a th...
|
8.8 High | — | 0,13% | 25 Sep 2026 |
|
CVE-2026-19775
The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1...
|
4.3 Medium | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-14281
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up t...
|
9.8 Critical | — | 0,53% | 25 Sep 2026 |
|
CVE-2026-97721
A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publi...
|
2.7 Low | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-97818
phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.
|
8.6 High | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-97764
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of...
|
3.7 Low | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-97737
In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.
|
7.4 High | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-97736
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
|
5.4 Medium | — | 0,21% | 25 Sep 2026 |
|
CVE-2026-97735
ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.
|
8.0 High | — | 0,25% | 25 Sep 2026 |
|
CVE-2026-97732
IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WI...
|
5.1 Medium | — | 0,06% | 25 Sep 2026 |
|
CVE-2025-14814
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including,...
|
6.4 Medium | — | 0,16% | 25 Sep 2026 |
|
CVE-2026-97731
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders()...
|
7.1 High | — | 0,17% | 25 Sep 2026 |
|
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling al...
|
8.5 High | — | 1,0% | 25 Sep 2026 |
|
CVE-2026-97724
A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify...
|
4.3 Medium | — | 0,25% | 25 Sep 2026 |
|
CVE-2026-97650
A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the...
|
4.3 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-97723
madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages...
|
5.4 Medium | — | 0,21% | 25 Sep 2026 |
|
CVE-2026-97649
A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is an unknown functionality o...
|
4.7 Medium | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-97648
A vulnerability was detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function. Performing a manipul...
|
4.3 Medium | — | 0,16% | 25 Sep 2026 |
|
CVE-2026-97647
A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the...
|
5.3 Medium | — | 0,31% | 25 Sep 2026 |
|
CVE-2026-95811
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass...
|
6.5 Medium | — | 0,40% | 25 Sep 2026 |
|
CVE-2026-97646
A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/...
|
7.3 High | — | 0,30% | 25 Sep 2026 |