Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-16302
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_ass...
|
4.3 Medium | — | 0,19% | 24 Sep 2026 |
|
CVE-2026-97179
A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java...
|
4.3 Medium | — | 0,33% | 24 Sep 2026 |
|
CVE-2026-79680
Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates...
|
4.5 Medium | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-4638
PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passe...
|
7.1 High | — | 0,27% | 24 Sep 2026 |
|
CVE-2026-92905
ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malfo...
|
5.3 Medium | — | 0,97% | 24 Sep 2026 |
|
CVE-2026-57590
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user ha...
|
8.1 High | — | 0,23% | 24 Sep 2026 |
|
CVE-2026-4637
Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent...
|
5.1 Medium | — | 0,55% | 24 Sep 2026 |
|
CVE-2026-18335
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and includi...
|
5.4 Medium | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-15731
The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and i...
|
6.4 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-12227
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parame...
|
9.8 Critical | — | 2,9% | 24 Sep 2026 |
|
CVE-2026-97185
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-...
|
7.8 High | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-85682
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest...
|
8.8 High | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-78313
Improper Access Control in DIAEnergie.
This issue affects DIAEnergie: before 1.11.00.022.
|
6.5 Medium | — | 0,46% | 24 Sep 2026 |
|
CVE-2026-78312
Path Traversal in DIAEnergie.
This issue affects DIAEnergie: before 1.11.00.022.
|
9.1 Critical | — | 0,35% | 24 Sep 2026 |
|
CVE-2026-78311
SQL Injection vulnerability in DIAEnergie.
This issue affects DIAEnergie: before 1.11.00.022.
|
8.8 High | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-78310
Authorization Bypass Through User-Controlled Key in DIAEnergie.
This issue affects DIAEnergie: before 1.11.00.022.
|
4.3 Medium | — | 0,21% | 24 Sep 2026 |
|
CVE-2026-78309
SQL Injection vulnerability in DIAEnergie.
This issue affects DIAEnergie: before 1.11.00.022.
|
8.8 High | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-78308
Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass.
This issue affects DIAEnergie: before 1.11.00.022.
|
9.8 Critical | — | 0,37% | 24 Sep 2026 |
|
CVE-2026-77193
The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. T...
|
7.5 High | — | 0,36% | 24 Sep 2026 |
|
CVE-2026-97181
GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs.
|
5.3 Medium | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-87739
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation reques...
|
6.9 Medium | — | 0,38% | 24 Sep 2026 |
|
CVE-2026-82077
An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authen...
|
7.3 High | — | 0,74% | 24 Sep 2026 |
|
CVE-2026-81645
Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.
|
5.9 Medium | — | 0,09% | 24 Sep 2026 |
|
CVE-2026-11744
An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the...
|
3.8 Low | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-97177
A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific pass...
|
6.6 Medium | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-97176
A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically...
|
4.2 Medium | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-93662
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, lettin...
|
4.3 Medium | — | 0,18% | 24 Sep 2026 |
|
CVE-2026-93661
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a...
|
2.7 Low | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-89005
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, whi...
|
6.8 Medium | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-89004
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, a...
|
2.7 Low | — | 0,22% | 24 Sep 2026 |
|
CVE-2026-89002
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which cou...
|
6.8 Medium | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-88847
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, a...
|
4.3 Medium | — | 0,15% | 24 Sep 2026 |
|
CVE-2026-88846
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through on...
|
5.3 Medium | — | 0,18% | 24 Sep 2026 |
|
CVE-2026-88845
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any...
|
4.3 Medium | — | 0,15% | 24 Sep 2026 |
|
CVE-2026-88843
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowin...
|
7.2 High | — | 0,36% | 24 Sep 2026 |
|
CVE-2026-84151
The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users wit...
|
3.5 Low | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-82850
The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct...
|
4.3 Medium | — | 0,18% | 24 Sep 2026 |
|
CVE-2026-82849
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authentica...
|
4.3 Medium | — | 0,16% | 24 Sep 2026 |
|
CVE-2026-82195
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosi...
|
6.5 Medium | — | 0,23% | 24 Sep 2026 |
|
CVE-2026-80513
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing auth...
|
7.5 High | — | 0,31% | 24 Sep 2026 |
|
CVE-2026-80338
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitr...
|
6.8 Medium | — | 0,18% | 24 Sep 2026 |
|
CVE-2026-74991
The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowi...
|
6.8 Medium | — | 0,18% | 24 Sep 2026 |
|
CVE-2026-14780
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execut...
|
7.5 High | — | 0,31% | 24 Sep 2026 |
|
CVE-2026-97155
Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web orig...
|
6.5 Medium | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-97152
Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Ve...
|
8.6 High | — | 0,31% | 24 Sep 2026 |
|
CVE-2026-97151
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attac...
|
8.4 High | — | 0,36% | 24 Sep 2026 |
|
CVE-2026-96898
A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component U...
|
7.3 High | — | 0,42% | 24 Sep 2026 |
|
CVE-2026-96892
A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argumen...
|
4.3 Medium | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-97149
In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and p...
|
5.3 Medium | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-96891
A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of th...
|
9.8 Critical | — | 0,65% | 24 Sep 2026 |