Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-87981
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration,...
|
4.7 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-87979
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated...
|
5.3 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-87074
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient addre...
|
3.7 Low | — | 0,15% | 23 Sep 2026 |
|
CVE-2026-87069
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during th...
|
3.1 Low | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-86842
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Autho...
|
6.8 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-86785
The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to...
|
5.3 Medium | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-86783
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom fiel...
|
5.3 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-86608
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing una...
|
8.2 High | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-86603
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber...
|
4.3 Medium | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-86602
The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber...
|
4.3 Medium | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-85006
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, al...
|
6.8 Medium | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-84743
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privil...
|
3.8 Low | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-84742
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing...
|
2.7 Low | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-84741
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response,...
|
5.3 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-84168
The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page...
|
5.3 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-84150
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the a...
|
5.4 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-84098
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it,...
|
6.5 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-84046
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-si...
|
5.0 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-84027
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its...
|
4.3 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-84026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user reco...
|
5.3 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-83555
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status...
|
5.3 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-82843
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being...
|
9.0 Critical | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-81339
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any auth...
|
4.3 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-81338
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and renderin...
|
4.6 Medium | — | 0,09% | 23 Sep 2026 |
|
CVE-2026-80342
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce ord...
|
6.5 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-77766
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the request...
|
4.3 Medium | — | 0,20% | 23 Sep 2026 |
|
CVE-2026-77765
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building...
|
5.3 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-75799
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated at...
|
9.0 Critical | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-19438
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Mint Workbench I.
This issue affects Mint Workbench I: through 5876.
|
7.5 High | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-18365
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to di...
|
4.3 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-18364
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account t...
|
4.3 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-16264
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauth...
|
6.5 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-14321
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attacker...
|
8.2 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2025-15696
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users...
|
6.8 Medium | — | 0,29% | 23 Sep 2026 |
|
CVE-2022-4997
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticate...
|
8.6 High | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-96258
A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the comp...
|
4.3 Medium | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-96257
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing...
|
10.0 Critical | — | 0,58% | 23 Sep 2026 |
|
CVE-2026-95958
A security flaw has been discovered in JusticeRage Manalyze 1.0.0. Impacted is the function PE::_parse_relocations of the file manape/pe.cpp of the component PE Parser. P...
|
3.3 Low | — | 0,11% | 23 Sep 2026 |
|
CVE-2026-95957
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file student_signup.php of th...
|
4.3 Medium | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-95930
A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debu...
|
6.3 Medium | — | 0,30% | 23 Sep 2026 |
|
CVE-2026-95929
A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotM...
|
6.3 Medium | — | 0,23% | 23 Sep 2026 |
|
CVE-2026-91777
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved...
|
7.5 High | — | 0,45% | 23 Sep 2026 |
|
CVE-2026-91776
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorp...
|
7.5 High | — | 0,45% | 23 Sep 2026 |
|
CVE-2026-89425
UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a...
|
7.5 High | — | 0,49% | 23 Sep 2026 |
|
CVE-2026-95928
A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_i...
|
5.5 Medium | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-95927
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/pretes...
|
7.3 High | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-95926
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/admins/assessm...
|
7.3 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-96273
Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects per...
|
5.5 Medium | — | 0,10% | 23 Sep 2026 |
|
CVE-2026-96272
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE a...
|
7.5 High | — | 0,32% | 23 Sep 2026 |
|
CVE-2026-96271
Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums...
|
7.1 High | — | 0,23% | 23 Sep 2026 |