Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-25255
qualcomm package manager, qualcomm software center
Exposed dangerous function lead to privilege escalation via gRPC server.
|
7.8 High | — | 0,08% | 22 Sep 2026 |
|
CVE-2026-25254
qualcomm software center
Improper authorization leads to Remote Code Execution via SocketIO interface.
|
9.8 Critical | — | 0,32% | 22 Sep 2026 |
|
CVE-2026-95508
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCP...
|
7.4 High | — | 0,57% | 22 Sep 2026 |
|
CVE-2026-9231
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0...
|
7.5 High | — | 0,58% | 22 Sep 2026 |
|
CVE-2026-93928
Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass.
This issue a...
|
7.3 High | — | 0,40% | 22 Sep 2026 |
|
CVE-2026-93556
The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery...
|
9.3 Critical | — | 0,31% | 22 Sep 2026 |
|
CVE-2026-89422
Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pr...
|
9.3 Critical | — | 0,46% | 22 Sep 2026 |
|
CVE-2026-68956
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening...
|
7.1 High | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-65634
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a craft...
|
8.2 High | — | 0,27% | 22 Sep 2026 |
|
CVE-2026-15095
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up...
|
4.9 Medium | — | 1,1% | 22 Sep 2026 |
|
CVE-2026-95503
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used wi...
|
6.8 Medium | — | 0,19% | 22 Sep 2026 |
|
CVE-2026-93952
Advisory
arista velocloud orchestrator
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host...
|
10.0 Critical | KEV | 1,1% | 22 Sep 2026 |
|
CVE-2026-9004
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the '...
|
4.3 Medium | — | 0,37% | 22 Sep 2026 |
|
CVE-2026-93836
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8....
|
7.2 High | — | 0,24% | 22 Sep 2026 |
|
CVE-2026-93778
The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up...
|
7.2 High | — | 0,43% | 22 Sep 2026 |
|
CVE-2026-92969
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 's...
|
8.1 High | — | 0,65% | 22 Sep 2026 |
|
CVE-2026-92235
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software al...
|
8.1 High | — | 0,36% | 22 Sep 2026 |
|
CVE-2026-91092
The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying...
|
4.3 Medium | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-87082
Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode.
Neither backend checks that its...
|
7.5 High | — | 0,42% | 22 Sep 2026 |
|
CVE-2026-87081
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii.
to_ascii pu...
|
7.5 High | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-87080
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode.
The pure-Perl decode...
|
9.1 Critical | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-87079
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode.
The XS backend inserts...
|
7.5 High | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-87078
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode.
The XS backend allocates the scalar it re...
|
9.1 Critical | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-7622
The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verific...
|
4.3 Medium | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-74766
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode....
|
8.4 High | — | 0,14% | 22 Sep 2026 |
|
CVE-2026-74765
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode.
The XS backend keeps the...
|
6.5 Medium | — | 0,33% | 22 Sep 2026 |
|
CVE-2026-6922
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to...
|
7.1 High | — | 0,56% | 22 Sep 2026 |
|
CVE-2026-4123
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capabili...
|
4.3 Medium | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-18439
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via th...
|
4.3 Medium | — | 0,25% | 22 Sep 2026 |
|
CVE-2026-1645
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting in all versions up to, and i...
|
4.4 Medium | — | 0,19% | 22 Sep 2026 |
|
CVE-2026-18345
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versi...
|
4.3 Medium | — | 0,20% | 22 Sep 2026 |
|
CVE-2026-16778
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content...
|
6.4 Medium | — | 0,22% | 22 Sep 2026 |
|
CVE-2026-12995
The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due t...
|
4.3 Medium | — | 0,21% | 22 Sep 2026 |
|
CVE-2025-1281
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_...
|
8.8 High | — | 0,57% | 22 Sep 2026 |
|
CVE-2025-1280
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax()...
|
6.5 Medium | — | 0,53% | 22 Sep 2026 |
|
CVE-2025-14487
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0...
|
5.3 Medium | — | 0,23% | 22 Sep 2026 |
|
CVE-2025-14486
The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This ma...
|
5.3 Medium | — | 0,23% | 22 Sep 2026 |
|
CVE-2025-14484
The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. Th...
|
5.3 Medium | — | 0,23% | 22 Sep 2026 |
|
CVE-2016-15059
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode.
The XS backend builds the...
|
9.8 Critical | — | 0,42% | 22 Sep 2026 |
|
CVE-2026-94504
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the...
|
7.2 High | — | 0,41% | 22 Sep 2026 |
|
CVE-2026-92438
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could al...
|
8.8 High | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-91827
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to...
|
7.5 High | — | 0,30% | 22 Sep 2026 |
|
CVE-2026-89412
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion...
|
7.2 High | — | 0,53% | 22 Sep 2026 |
|
CVE-2026-93655
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3...
|
6.1 Medium | — | 0,37% | 22 Sep 2026 |
|
CVE-2026-88788
The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does n...
|
6.8 Medium | — | 0,43% | 22 Sep 2026 |
|
CVE-2026-85653
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, and including...
|
6.4 Medium | — | 0,42% | 22 Sep 2026 |
|
CVE-2026-12470
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation du...
|
7.2 High | — | 0,33% | 22 Sep 2026 |
|
CVE-2026-19658
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This mak...
|
9.8 Critical | — | 0,53% | 22 Sep 2026 |
|
CVE-2026-13355
The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the...
|
9.8 Critical | — | 0,44% | 22 Sep 2026 |
|
CVE-2026-94493
A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Servi...
|
10.0 Critical | — | 0,73% | 22 Sep 2026 |