Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-84027
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its...
|
4.3 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-84026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user reco...
|
5.3 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-83555
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status...
|
5.3 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-82843
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being...
|
9.0 Critical | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-81339
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any auth...
|
4.3 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-81338
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and renderin...
|
4.6 Medium | — | 0,09% | 23 Sep 2026 |
|
CVE-2026-80342
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce ord...
|
6.5 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-77766
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the request...
|
4.3 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-77765
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building...
|
5.3 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-75799
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated at...
|
9.0 Critical | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-19438
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Mint Workbench I.
This issue affects Mint Workbench I: through 5876.
|
7.5 High | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-18365
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to di...
|
4.3 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-18364
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account t...
|
4.3 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-16264
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauth...
|
6.5 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-14321
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attacker...
|
8.2 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2025-15696
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users...
|
6.8 Medium | — | 0,29% | 23 Sep 2026 |
|
CVE-2022-4997
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticate...
|
8.6 High | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-96258
A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the comp...
|
4.3 Medium | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-96257
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing...
|
10.0 Critical | — | 0,58% | 23 Sep 2026 |
|
CVE-2026-95958
A security flaw has been discovered in JusticeRage Manalyze 1.0.0. Impacted is the function PE::_parse_relocations of the file manape/pe.cpp of the component PE Parser. P...
|
3.3 Low | — | 0,11% | 23 Sep 2026 |
|
CVE-2026-95957
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file student_signup.php of th...
|
4.3 Medium | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-95930
A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debu...
|
6.3 Medium | — | 0,30% | 23 Sep 2026 |
|
CVE-2026-95929
A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotM...
|
6.3 Medium | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-91777
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved...
|
7.5 High | — | 0,45% | 23 Sep 2026 |
|
CVE-2026-91776
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorp...
|
7.5 High | — | 0,45% | 23 Sep 2026 |
|
CVE-2026-89425
UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a...
|
7.5 High | — | 0,49% | 23 Sep 2026 |
|
CVE-2026-95928
A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_i...
|
5.5 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-95927
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/pretes...
|
7.3 High | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-95926
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/admins/assessm...
|
7.3 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-96273
Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects per...
|
5.5 Medium | — | 0,10% | 23 Sep 2026 |
|
CVE-2026-96272
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE a...
|
7.5 High | — | 0,32% | 23 Sep 2026 |
|
CVE-2026-96271
Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums...
|
7.1 High | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-95925
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/...
|
7.3 High | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-95924
A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/databan...
|
7.3 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-95897
A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such m...
|
5.5 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-95868
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is the function mysql...
|
6.3 Medium | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-95833
A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of...
|
6.3 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-95830
A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /post_u...
|
6.3 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-95829
A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-...
|
6.3 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-94367
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafte...
|
7.2 High | — | 1,0% | 23 Sep 2026 |
|
CVE-2026-92930
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side c...
|
6.2 Medium | — | 0,16% | 23 Sep 2026 |
|
CVE-2026-92929
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address....
|
5.3 Medium | — | 0,36% | 23 Sep 2026 |
|
CVE-2026-92928
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled...
|
6.5 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-95828
A vulnerability was determined in Mstfakts College-Management-System. This affects the function session_start of the file Front-end/server.php of the component Authentica...
|
4.3 Medium | — | 0,49% | 22 Sep 2026 |
|
CVE-2026-95820
A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of t...
|
6.3 Medium | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-61685
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HT...
|
7.5 High | — | 0,53% | 22 Sep 2026 |
|
CVE-2026-57576
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app...
|
6.5 Medium | — | 0,76% | 22 Sep 2026 |
|
CVE-2026-18176
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive info...
|
7.4 High | — | 0,13% | 22 Sep 2026 |
|
CVE-2026-18173
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authe...
|
3.7 Low | — | 0,24% | 22 Sep 2026 |
|
CVE-2026-18172
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external ent...
|
7.4 High | — | 0,20% | 22 Sep 2026 |