Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-91800
foxit pdf editor, foxit pdf reader
A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value d...
|
8.8 High | — | 0,10% | 23 Sep 2026 |
|
CVE-2026-91799
foxit pdf editor, foxit pdf reader
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a rel...
|
7.8 High | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-91798
A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuratio...
|
8.8 High | — | 0,10% | 23 Sep 2026 |
|
CVE-2026-91797
foxit pdf editor, foxit pdf reader
Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to direct...
|
7.8 High | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-91796
foxit pdf editor, foxit pdf reader
The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentica...
|
6.1 Medium | — | 0,12% | 23 Sep 2026 |
|
CVE-2026-91795
foxit pdf editor, foxit pdf reader
Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in...
|
7.8 High | — | 0,08% | 23 Sep 2026 |
|
CVE-2026-91794
An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processin...
|
7.8 High | — | 0,16% | 23 Sep 2026 |
|
CVE-2026-91793
foxit pdf editor, foxit pdf reader
When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subseque...
|
7.8 High | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-91792
foxit pdf editor, foxit pdf reader
When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions....
|
7.8 High | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-91791
foxit pdf editor, foxit pdf reader
When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility even...
|
7.8 High | — | 0,14% | 23 Sep 2026 |
|
CVE-2026-91790
foxit pdf editor, foxit pdf reader
When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a result, the prog...
|
7.8 High | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-91789
foxit pdf editor, foxit pdf reader
Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information. Under certain conditions, this...
|
7.8 High | — | 0,16% | 23 Sep 2026 |
|
CVE-2026-91788
When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trust...
|
4.7 Medium | — | 0,10% | 23 Sep 2026 |
|
CVE-2026-50228
An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP...
|
6.1 Medium | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-50227
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62)....
|
6.1 Medium | — | 0,35% | 23 Sep 2026 |
|
CVE-2026-82331
Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows malicious so...
|
9.8 Critical | — | 0,42% | 23 Sep 2026 |
|
CVE-2026-6831
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not prop...
|
6.5 Medium | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-5924
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to,...
|
6.4 Medium | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-93528
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attacker...
|
3.7 Low | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-93511
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthen...
|
5.3 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-93510
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, al...
|
4.3 Medium | — | 0,15% | 23 Sep 2026 |
|
CVE-2026-93508
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-l...
|
8.1 High | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-93507
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users...
|
3.3 Low | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-91077
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so...
|
2.7 Low | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-91073
The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with...
|
6.8 Medium | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-91025
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings ta...
|
4.3 Medium | — | 0,15% | 23 Sep 2026 |
|
CVE-2026-91024
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, all...
|
6.8 Medium | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-90985
The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its compari...
|
5.3 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-90951
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who hol...
|
3.7 Low | — | 0,15% | 23 Sep 2026 |
|
CVE-2026-89331
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated us...
|
5.3 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-88997
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-...
|
6.8 Medium | — | 0,29% | 23 Sep 2026 |
|
CVE-2026-88929
The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to una...
|
5.3 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-87981
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration,...
|
4.7 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-87979
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated...
|
5.3 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-87074
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient addre...
|
3.7 Low | — | 0,15% | 23 Sep 2026 |
|
CVE-2026-87069
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during th...
|
3.1 Low | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-86842
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Autho...
|
6.8 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-86785
The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to...
|
5.3 Medium | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-86783
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom fiel...
|
5.3 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-86608
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing una...
|
8.2 High | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-86603
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber...
|
4.3 Medium | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-86602
The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber...
|
4.3 Medium | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-85006
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, al...
|
6.8 Medium | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-84743
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privil...
|
3.8 Low | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-84742
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing...
|
2.7 Low | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-84741
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response,...
|
5.3 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-84168
The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page...
|
5.3 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-84150
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the a...
|
5.4 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-84098
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it,...
|
6.5 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-84046
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-si...
|
5.0 Medium | — | 0,20% | 23 Sep 2026 |