Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-89058
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin...
|
7.4 High | — | 0,25% | 18 Sep 2026 |
|
CVE-2026-85705
The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including,...
|
7.5 High | — | 0,46% | 18 Sep 2026 |
|
CVE-2026-85652
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versio...
|
6.5 Medium | — | 0,55% | 18 Sep 2026 |
|
CVE-2026-75961
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up t...
|
4.9 Medium | — | 0,51% | 18 Sep 2026 |
|
CVE-2026-75157
Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag...
|
7.5 High | — | 0,44% | 18 Sep 2026 |
|
CVE-2026-67103
hcltech bigfix service management
HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute...
|
6.1 Medium | — | 0,20% | 18 Sep 2026 |
|
CVE-2026-67102
hcltech bigfix service management
HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to a...
|
8.1 High | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-67101
hcltech bigfix service management
HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the ap...
|
5.8 Medium | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-67100
hcltech bigfix service management
HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inje...
|
9.8 Critical | — | 0,47% | 18 Sep 2026 |
|
CVE-2026-18442
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in...
|
7.5 High | — | 0,50% | 18 Sep 2026 |
|
CVE-2026-17607
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and inc...
|
6.5 Medium | — | 0,34% | 18 Sep 2026 |
|
CVE-2026-17586
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta in all versions up to, and in...
|
6.4 Medium | — | 0,31% | 18 Sep 2026 |
|
CVE-2026-16777
The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and in...
|
4.9 Medium | — | 0,66% | 18 Sep 2026 |
|
CVE-2026-15275
The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and inc...
|
7.5 High | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-15004
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to,...
|
5.4 Medium | — | 0,24% | 18 Sep 2026 |
|
CVE-2026-14472
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to, and including, 2.8.4...
|
6.4 Medium | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-14323
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the...
|
7.5 High | — | 0,94% | 18 Sep 2026 |
|
CVE-2026-13471
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl...
|
4.3 Medium | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-12954
The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the `my_profile_update()` function. T...
|
8.8 High | — | 0,46% | 18 Sep 2026 |
|
CVE-2026-12739
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. Thi...
|
4.3 Medium | — | 0,34% | 18 Sep 2026 |
|
CVE-2026-12384
Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse.
This issue affects TECHIN2B Application: from V1....
|
8.8 High | — | 0,31% | 18 Sep 2026 |
|
CVE-2026-11757
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows...
|
6.1 Medium | — | 0,18% | 18 Sep 2026 |
|
CVE-2026-92714
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked o...
|
6.5 Medium | — | 0,42% | 18 Sep 2026 |
|
CVE-2026-92619
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action....
|
7.2 High | — | 0,66% | 18 Sep 2026 |
|
CVE-2026-92561
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to...
|
6.1 Medium | — | 0,41% | 18 Sep 2026 |
|
CVE-2026-91707
The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users t...
|
5.3 Medium | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-90977
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the...
|
5.3 Medium | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-90976
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthen...
|
5.3 Medium | — | 0,30% | 18 Sep 2026 |
|
CVE-2026-89413
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifyin...
|
8.1 High | — | 0,54% | 18 Sep 2026 |
|
CVE-2026-89330
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Sc...
|
6.1 Medium | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-89278
The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all...
|
5.3 Medium | — | 0,44% | 18 Sep 2026 |
|
CVE-2026-89138
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifyin...
|
4.3 Medium | — | 0,39% | 18 Sep 2026 |
|
CVE-2026-88994
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, a...
|
6.6 Medium | — | 0,39% | 18 Sep 2026 |
|
CVE-2026-86800
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dro...
|
5.3 Medium | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-86796
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and lo...
|
5.3 Medium | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-84909
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all...
|
6.4 Medium | — | 0,41% | 18 Sep 2026 |
|
CVE-2026-79713
The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with...
|
6.5 Medium | — | 0,29% | 18 Sep 2026 |
|
CVE-2026-75017
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization b...
|
4.3 Medium | — | 0,42% | 18 Sep 2026 |
|
CVE-2026-75016
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8...
|
6.4 Medium | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-18317
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inc...
|
4.3 Medium | — | 0,21% | 18 Sep 2026 |
|
CVE-2026-17576
The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13.9. This is due to insufficien...
|
6.5 Medium | — | 0,27% | 18 Sep 2026 |
|
CVE-2026-12106
The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage functio...
|
6.4 Medium | — | 0,25% | 18 Sep 2026 |
|
CVE-2024-38639
An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the sy...
|
4.8 Medium | — | 0,25% | 18 Sep 2026 |
|
CVE-2024-27123
A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or...
|
5.2 Medium | — | 0,13% | 18 Sep 2026 |
|
CVE-2026-93485
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affec...
|
7.1 High | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-90984
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form conte...
|
5.8 Medium | — | 0,32% | 18 Sep 2026 |
|
CVE-2026-90978
The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability chec...
|
7.1 High | — | 0,34% | 18 Sep 2026 |
|
CVE-2026-89008
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing...
|
2.7 Low | — | 0,32% | 18 Sep 2026 |
|
CVE-2026-89007
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing use...
|
2.7 Low | — | 0,28% | 18 Sep 2026 |
|
CVE-2026-88993
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Co...
|
6.8 Medium | — | 0,43% | 18 Sep 2026 |