Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-84750
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores th...
|
6.5 Medium | — | 0,45% | 19 Sep 2026 |
|
CVE-2026-76790
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in a...
|
7.1 High | — | 0,25% | 19 Sep 2026 |
|
CVE-2026-76554
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles,...
|
7.2 High | — | 0,46% | 19 Sep 2026 |
|
CVE-2026-19860
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validati...
|
5.5 Medium | — | 0,23% | 19 Sep 2026 |
|
CVE-2026-16557
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, a...
|
4.3 Medium | — | 0,18% | 19 Sep 2026 |
|
CVE-2025-15698
The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor...
|
3.5 Low | — | 0,14% | 19 Sep 2026 |
|
CVE-2026-93741
A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The man...
|
10.0 Critical | — | 0,66% | 19 Sep 2026 |
|
CVE-2026-92967
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insu...
|
6.1 Medium | — | 0,38% | 19 Sep 2026 |
|
CVE-2026-92807
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the `pdf_created_ca...
|
8.8 High | — | 0,46% | 19 Sep 2026 |
|
CVE-2026-92229
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and...
|
9.1 Critical | — | 0,73% | 19 Sep 2026 |
|
CVE-2026-89334
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includ...
|
6.5 Medium | — | 0,70% | 19 Sep 2026 |
|
CVE-2026-89333
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 vi...
|
6.5 Medium | — | 0,46% | 19 Sep 2026 |
|
CVE-2026-89274
The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because `WP...
|
9.1 Critical | — | 0,68% | 19 Sep 2026 |
|
CVE-2026-89093
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to...
|
5.3 Medium | — | 0,56% | 19 Sep 2026 |
|
CVE-2026-89081
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to...
|
6.1 Medium | — | 0,38% | 19 Sep 2026 |
|
CVE-2026-88944
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due t...
|
4.3 Medium | — | 0,46% | 19 Sep 2026 |
|
CVE-2026-87909
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient saniti...
|
7.5 High | — | 0,91% | 19 Sep 2026 |
|
CVE-2026-84434
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a...
|
9.8 Critical | — | 3,9% | 19 Sep 2026 |
|
CVE-2026-15760
The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxt...
|
6.5 Medium | — | 0,22% | 19 Sep 2026 |
|
CVE-2026-15660
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the hand...
|
4.3 Medium | — | 0,20% | 19 Sep 2026 |
|
CVE-2026-13354
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5...
|
7.2 High | — | 0,24% | 19 Sep 2026 |
|
CVE-2026-12042
The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insuff...
|
4.4 Medium | — | 0,21% | 19 Sep 2026 |
|
CVE-2026-77820
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insu...
|
6.4 Medium | — | 0,33% | 19 Sep 2026 |
|
CVE-2026-93923
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply cr...
|
8.8 High | — | 0,60% | 19 Sep 2026 |
|
CVE-2026-93922
SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. A...
|
8.8 High | — | 0,82% | 19 Sep 2026 |
|
CVE-2026-93921
SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attacke...
|
4.3 Medium | — | 0,38% | 19 Sep 2026 |
|
CVE-2026-77875
The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can acces...
|
6.8 Medium | — | 0,19% | 19 Sep 2026 |
|
CVE-2026-93740
A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the ar...
|
10.0 Critical | — | 0,88% | 18 Sep 2026 |
|
CVE-2026-93739
A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the arg...
|
9.9 Critical | — | 0,85% | 18 Sep 2026 |
|
CVE-2026-75885
A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted de...
|
9.3 Critical | — | 0,82% | 18 Sep 2026 |
|
CVE-2026-93894
In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denia...
|
2.3 Low | — | 0,36% | 18 Sep 2026 |
|
CVE-2026-93738
A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the...
|
9.9 Critical | — | 0,85% | 18 Sep 2026 |
|
CVE-2026-93574
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that...
|
6.5 Medium | — | 1,4% | 18 Sep 2026 |
|
CVE-2026-93562
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By se...
|
6.5 Medium | — | 0,41% | 18 Sep 2026 |
|
CVE-2026-88097
microsoft edge chromium
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
|
7.8 High | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-85272
Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is...
|
4.3 Medium | — | 0,48% | 18 Sep 2026 |
|
CVE-2026-85271
Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notificatio...
|
6.1 Medium | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-71855
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat...
|
7.5 High | — | 0,31% | 18 Sep 2026 |
|
CVE-2026-71418
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing i...
|
7.5 High | — | 0,62% | 18 Sep 2026 |
|
CVE-2026-68928
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in...
|
8.6 High | — | 0,20% | 18 Sep 2026 |
|
CVE-2026-63452
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits dec...
|
7.5 High | — | 0,63% | 18 Sep 2026 |
|
CVE-2026-63451
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection...
|
5.5 Medium | — | 0,15% | 18 Sep 2026 |
|
CVE-2026-63450
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp....
|
5.3 Medium | — | 0,25% | 18 Sep 2026 |
|
CVE-2026-63449
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/s...
|
5.3 Medium | — | 0,25% | 18 Sep 2026 |
|
CVE-2026-63448
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain...
|
7.5 High | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-63447
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-la...
|
7.5 High | — | 0,63% | 18 Sep 2026 |
|
CVE-2026-63446
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransaction...
|
7.5 High | — | 0,68% | 18 Sep 2026 |
|
CVE-2026-61670
microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --n...
|
6.5 Medium | — | 0,11% | 18 Sep 2026 |
|
CVE-2026-57229
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust...
|
5.3 Medium | — | 0,41% | 18 Sep 2026 |
|
CVE-2026-57228
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-print...
|
9.1 Critical | — | 0,42% | 18 Sep 2026 |