Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-84706
A flaw was found in Ansible Automation Platform's automation-controller. The custom
Credential Type environment-variable injector validates variable names against a
deny-...
|
7.6 High | — | 0,31% | 23 Sep 2026 |
|
CVE-2026-84691
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The setting that formats the log message emitted for API 4XX errors
is an administrator-...
|
8.7 High | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-84683
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The HTML view of job, ad hoc command, project update, and inventory
update standard outp...
|
8.7 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-82409
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled ac...
|
8.4 High | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-82407
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path a...
|
7.0 High | — | 0,43% | 23 Sep 2026 |
|
CVE-2026-82406
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsCla...
|
7.1 High | — | 0,34% | 23 Sep 2026 |
|
CVE-2026-82405
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target accou...
|
8.7 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-75884
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of...
|
9.1 Critical | — | 0,41% | 23 Sep 2026 |
|
CVE-2026-68492
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as...
|
8.7 High | — | 0,38% | 23 Sep 2026 |
|
CVE-2026-68490
Advisory
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.
|
8.2 High | — | 0,14% | 23 Sep 2026 |
|
CVE-2026-67238
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and...
|
7.1 High | — | 0,33% | 23 Sep 2026 |
|
CVE-2026-66079
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an elemen...
|
8.2 High | — | 0,32% | 23 Sep 2026 |
|
CVE-2026-66076
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which c...
|
2.3 Low | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-66070
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credenti...
|
7.6 High | — | 0,41% | 23 Sep 2026 |
|
CVE-2026-96872
Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows...
|
2.9 Low | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-96770
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerifica...
|
9.3 Critical | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-96549
A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssm_pro/src/main...
|
3.3 Low | — | 0,08% | 23 Sep 2026 |
|
CVE-2026-96548
A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.prop...
|
5.6 Medium | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-96546
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an u...
|
2.5 Low | — | 0,11% | 23 Sep 2026 |
|
CVE-2026-96545
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug...
|
4.4 Medium | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-96541
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the co...
|
7.5 High | — | 0,79% | 23 Sep 2026 |
|
CVE-2026-95604
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
|
7.5 High | — | 0,33% | 23 Sep 2026 |
|
CVE-2026-95603
Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.
|
7.2 High | — | 0,40% | 23 Sep 2026 |
|
CVE-2026-95602
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security L...
|
6.5 Medium | — | 0,28% | 23 Sep 2026 |
|
CVE-2026-95601
Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
|
9.3 Critical | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-95600
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.
|
5.3 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-95593
Editor SQL Injection in Ultimeter <= 3.0.8 versions.
|
7.6 High | — | 0,29% | 23 Sep 2026 |
|
CVE-2026-95592
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
|
5.3 Medium | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-95590
Subscriber SQL Injection in Tainacan <= 1.2.0 versions.
|
7.1 High | — | 0,29% | 23 Sep 2026 |
|
CVE-2026-95586
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
|
6.5 Medium | — | 0,16% | 23 Sep 2026 |
|
CVE-2026-95530
Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.
|
6.5 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-95529
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.
|
7.1 High | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-95528
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.
|
7.1 High | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-95527
Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.
|
6.5 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-95525
Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.
|
6.5 Medium | — | 0,47% | 23 Sep 2026 |
|
CVE-2026-95524
Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
|
5.3 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-95523
Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
|
6.5 Medium | — | 0,34% | 23 Sep 2026 |
|
CVE-2026-95522
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
|
7.6 High | — | 0,29% | 23 Sep 2026 |
|
CVE-2026-95515
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
|
7.1 High | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-95514
Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.
|
5.3 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-95513
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.
|
7.5 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-94682
Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.
|
6.5 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-94680
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
|
6.5 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-94679
Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.
|
5.4 Medium | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-94671
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
|
6.5 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-94500
Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.
|
6.5 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-94498
Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.
|
6.5 Medium | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-94487
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.
|
8.1 High | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-94461
Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.
|
6.5 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-94457
Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.
|
4.8 Medium | — | 0,19% | 23 Sep 2026 |