Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-94391
Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.
|
6.5 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-94181
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen...
|
7.4 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-94179
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
|
7.1 High | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-94176
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
|
7.1 High | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-94174
Administrator SQL Injection in Email Log <= 2.63 versions.
|
7.6 High | — | 0,29% | 23 Sep 2026 |
|
CVE-2026-94168
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
|
6.5 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-94124
Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.
|
8.5 High | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-94118
Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.
|
6.5 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-94080
Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.
|
5.3 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-94079
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
|
5.3 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-93774
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
|
7.1 High | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-93773
Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
|
8.5 High | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-93772
Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.
|
6.5 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-93623
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
|
5.3 Medium | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-93622
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
|
7.1 High | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-93620
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
|
6.5 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-93618
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS.
This issue a...
|
6.5 Medium | — | 0,16% | 23 Sep 2026 |
|
CVE-2026-93529
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
|
6.5 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-93527
Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.
|
8.5 High | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-93526
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
|
7.1 High | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-93513
Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
|
4.3 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-93421
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled documen...
|
5.3 Medium | — | 0,40% | 23 Sep 2026 |
|
CVE-2026-92730
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.
|
7.4 High | — | 0,39% | 23 Sep 2026 |
|
CVE-2026-92700
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sen...
|
6.3 Medium | — | 0,41% | 23 Sep 2026 |
|
CVE-2026-92692
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart C...
|
6.9 Medium | — | 0,33% | 23 Sep 2026 |
|
CVE-2026-92284
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the co...
|
6.9 Medium | — | 0,39% | 23 Sep 2026 |
|
CVE-2026-90905
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.ph...
|
7.2 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-90904
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in Api...
|
8.6 High | — | 0,31% | 23 Sep 2026 |
|
CVE-2026-90903
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiCon...
|
7.2 High | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-90902
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (admin...
|
8.6 High | — | 0,28% | 23 Sep 2026 |
|
CVE-2026-90901
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (ad...
|
8.6 High | — | 0,28% | 23 Sep 2026 |
|
CVE-2026-90900
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submi...
|
5.3 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-90899
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint al...
|
8.2 High | — | 0,33% | 23 Sep 2026 |
|
CVE-2026-84502
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The Project scm_url field is not validated against values that
begin with a dash and is...
|
9.9 Critical | — | 0,62% | 23 Sep 2026 |
|
CVE-2026-84499
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. Survey questions of type password are write-only and stored
encrypted, displayed only as...
|
7.7 High | — | 0,38% | 23 Sep 2026 |
|
CVE-2026-84486
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. Four debug views that trigger the internal task, dependency, and
workflow schedulers are...
|
8.2 High | — | 0,52% | 23 Sep 2026 |
|
CVE-2026-84474
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The provisioning-callback secret (host_config_key) is exposed to
users holding only the...
|
9.9 Critical | — | 0,80% | 23 Sep 2026 |
|
CVE-2026-82368
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backen...
|
8.7 High | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-82356
Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certific...
|
7.5 High | — | 0,11% | 23 Sep 2026 |
|
CVE-2026-77602
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administ...
|
9.9 Critical | — | 0,57% | 23 Sep 2026 |
|
CVE-2026-77601
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor ca...
|
8.8 High | — | 0,58% | 23 Sep 2026 |
|
CVE-2026-77423
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter pa...
|
7.5 High | — | 0,39% | 23 Sep 2026 |
|
CVE-2026-77422
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/Posix...
|
7.5 High | — | 0,50% | 23 Sep 2026 |
|
CVE-2026-77421
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search...
|
6.5 Medium | — | 0,43% | 23 Sep 2026 |
|
CVE-2026-77420
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java...
|
5.5 Medium | — | 0,12% | 23 Sep 2026 |
|
CVE-2026-77394
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor wit...
|
7.6 High | — | 0,39% | 23 Sep 2026 |
|
CVE-2026-77285
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard...
|
2.4 Low | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-76648
CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes =
(IsAuthenticated,), so DRF's get_object() performs no object-level
RBAC. The get() handler (lines 988–...
|
8.5 High | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-76089
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotif...
|
7.7 High | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-76087
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit tr...
|
8.2 High | — | 0,31% | 23 Sep 2026 |