Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-94028
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controller_group_re...
|
4.3 Medium | — | 0,45% | 20 Sep 2026 |
|
CVE-2026-94016
A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_symptom. Pe...
|
2.4 Low | — | 0,37% | 20 Sep 2026 |
|
CVE-2026-94015
A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drug_recommender/Admin/edit_user.php. Such...
|
7.3 High | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-92254
Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Wind...
|
6.9 Medium | — | 0,14% | 20 Sep 2026 |
|
CVE-2026-92253
Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attackers to caus...
|
5.2 Medium | — | 0,18% | 20 Sep 2026 |
|
CVE-2026-92252
Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus bi...
|
5.9 Medium | — | 0,14% | 20 Sep 2026 |
|
CVE-2026-90817
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could poten...
|
9.8 Critical | — | 0,88% | 20 Sep 2026 |
|
CVE-2026-94113
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce do...
|
6.5 Medium | — | 0,42% | 20 Sep 2026 |
|
CVE-2026-94112
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with...
|
6.8 Medium | — | 0,39% | 20 Sep 2026 |
|
CVE-2026-94111
Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origi...
|
6.6 Medium | — | 0,14% | 20 Sep 2026 |
|
CVE-2026-94109
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authen...
|
8.0 High | — | 0,78% | 20 Sep 2026 |
|
CVE-2026-94108
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before...
|
6.5 Medium | — | 0,54% | 20 Sep 2026 |
|
CVE-2026-94107
NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()),...
|
8.1 High | — | 0,57% | 20 Sep 2026 |
|
CVE-2026-94106
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious...
|
8.8 High | — | 1,7% | 20 Sep 2026 |
|
CVE-2026-94105
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable pa...
|
5.3 Medium | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-94104
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or wh...
|
8.8 High | — | 0,67% | 20 Sep 2026 |
|
CVE-2026-94004
A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytag_js.php. The manipulation of the argument aid result...
|
7.3 High | — | 0,52% | 20 Sep 2026 |
|
CVE-2026-94003
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management...
|
10.0 Critical | — | 0,61% | 20 Sep 2026 |
|
CVE-2026-93997
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the file /Admin/edit_symptom.php....
|
7.3 High | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-93980
A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Ad...
|
7.3 High | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-93979
A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of the file /employer/login.php. Performing a manipula...
|
7.3 High | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-93978
A vulnerability was identified in code-projects Internship Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Such manipu...
|
7.3 High | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-93977
A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark...
|
3.5 Low | — | 0,35% | 20 Sep 2026 |
|
CVE-2026-93976
A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument lev...
|
2.4 Low | — | 0,37% | 20 Sep 2026 |
|
CVE-2026-93975
A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing....
|
2.4 Low | — | 0,37% | 20 Sep 2026 |
|
CVE-2026-86555
The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the se...
|
6.2 Medium | — | 0,20% | 20 Sep 2026 |
|
CVE-2026-93974
A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/databank/btn_fu...
|
7.3 High | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-93973
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/admins/assessmen...
|
7.3 High | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-93972
A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/ad...
|
7.3 High | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-93971
A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This manipulation causes informati...
|
5.3 Medium | — | 0,54% | 20 Sep 2026 |
|
CVE-2026-93970
A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Se...
|
7.3 High | — | 0,50% | 20 Sep 2026 |
|
CVE-2026-86554
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authenti...
|
4.3 Medium | — | 0,33% | 20 Sep 2026 |
|
CVE-2026-93969
A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. The manipulat...
|
7.3 High | — | 0,50% | 20 Sep 2026 |
|
CVE-2026-93968
A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Ex...
|
3.8 Low | — | 0,45% | 20 Sep 2026 |
|
CVE-2026-93967
A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of the file backend/aiops/services.py of the component...
|
5.5 Medium | — | 0,73% | 20 Sep 2026 |
|
CVE-2026-93966
A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backend/ops/host_...
|
4.7 Medium | — | 1,6% | 20 Sep 2026 |
|
CVE-2026-92965
The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site...
|
3.7 Low | — | 0,24% | 20 Sep 2026 |
|
CVE-2026-92541
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing user...
|
7.2 High | — | 0,46% | 20 Sep 2026 |
|
CVE-2026-92540
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import,...
|
7.2 High | — | 0,46% | 20 Sep 2026 |
|
CVE-2026-92423
The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post dat...
|
2.7 Low | — | 0,32% | 20 Sep 2026 |
|
CVE-2026-92422
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the Word...
|
6.5 Medium | — | 0,16% | 20 Sep 2026 |
|
CVE-2026-92410
The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up...
|
4.3 Medium | — | 0,14% | 20 Sep 2026 |
|
CVE-2026-87840
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally ex...
|
5.3 Medium | — | 0,30% | 20 Sep 2026 |
|
CVE-2026-87839
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action availab...
|
7.5 High | — | 0,36% | 20 Sep 2026 |
|
CVE-2026-87068
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz...
|
6.6 Medium | — | 0,36% | 20 Sep 2026 |
|
CVE-2026-87067
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, all...
|
8.5 High | — | 0,47% | 20 Sep 2026 |
|
CVE-2026-85017
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data...
|
7.5 High | — | 0,40% | 20 Sep 2026 |
|
CVE-2026-84223
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to...
|
6.8 Medium | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-82842
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, al...
|
8.1 High | — | 0,37% | 20 Sep 2026 |
|
CVE-2026-81654
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allo...
|
3.1 Low | — | 0,21% | 20 Sep 2026 |