Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-88844
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data,...
|
2.7 Low | — | 0,30% | 18 Sep 2026 |
|
CVE-2026-88825
The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scr...
|
8.8 High | — | 0,51% | 18 Sep 2026 |
|
CVE-2026-88798
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, al...
|
5.3 Medium | — | 0,42% | 18 Sep 2026 |
|
CVE-2026-87966
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before...
|
5.3 Medium | — | 0,30% | 18 Sep 2026 |
|
CVE-2026-87965
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriv...
|
4.8 Medium | — | 0,27% | 18 Sep 2026 |
|
CVE-2026-87775
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to u...
|
8.6 High | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-87774
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to u...
|
8.6 High | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-87771
The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unaut...
|
8.6 High | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-87770
The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to...
|
8.6 High | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-87767
The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action avai...
|
8.6 High | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-85350
The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowin...
|
5.3 Medium | — | 0,30% | 18 Sep 2026 |
|
CVE-2026-85127
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor san...
|
8.8 High | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-85123
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allow...
|
5.3 Medium | — | 0,30% | 18 Sep 2026 |
|
CVE-2026-85122
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allow...
|
8.8 High | — | 0,51% | 18 Sep 2026 |
|
CVE-2026-85009
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unau...
|
6.5 Medium | — | 0,27% | 18 Sep 2026 |
|
CVE-2026-84904
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only...
|
3.8 Low | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-84903
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supp...
|
2.7 Low | — | 0,32% | 18 Sep 2026 |
|
CVE-2026-84902
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing...
|
6.8 Medium | — | 0,43% | 18 Sep 2026 |
|
CVE-2026-84738
The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged stor...
|
9.1 Critical | — | 0,82% | 18 Sep 2026 |
|
CVE-2026-81810
The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installa...
|
7.2 High | — | 0,46% | 18 Sep 2026 |
|
CVE-2026-81340
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API,...
|
3.8 Low | — | 0,32% | 18 Sep 2026 |
|
CVE-2026-18912
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitr...
|
7.7 High | — | 1,5% | 18 Sep 2026 |
|
CVE-2026-18911
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentic...
|
7.5 High | — | 1,1% | 18 Sep 2026 |
|
CVE-2026-17086
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5...
|
8.8 High | — | 0,89% | 18 Sep 2026 |
|
CVE-2026-93468
The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system fi...
|
7.5 High | — | 0,68% | 18 Sep 2026 |
|
CVE-2026-93467
The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending malicio...
|
9.8 Critical | — | 0,91% | 18 Sep 2026 |
|
CVE-2026-93371
A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downl...
|
8.3 High | — | 1,4% | 18 Sep 2026 |
|
CVE-2026-92991
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. Th...
|
5.4 Medium | — | 0,43% | 18 Sep 2026 |
|
CVE-2026-15650
The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute i...
|
6.4 Medium | — | 0,21% | 18 Sep 2026 |
|
CVE-2026-14855
The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and including, 1.5.1 due to insuff...
|
6.4 Medium | — | 0,20% | 18 Sep 2026 |
|
CVE-2026-93456
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page conte...
|
8.2 High | — | 0,20% | 18 Sep 2026 |
|
CVE-2026-93455
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored med...
|
6.5 Medium | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-93331
A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacketizer.c of the component RTP D...
|
7.3 High | — | 0,54% | 18 Sep 2026 |
|
CVE-2026-93314
A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipula...
|
6.3 Medium | — | 0,24% | 18 Sep 2026 |
|
CVE-2026-93313
A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performin...
|
6.3 Medium | — | 0,24% | 18 Sep 2026 |
|
CVE-2026-82985
The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the...
|
6.5 Medium | — | 0,38% | 18 Sep 2026 |
|
CVE-2026-82982
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file who...
|
4.3 Medium | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-82980
Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request...
|
6.3 Medium | — | 0,30% | 18 Sep 2026 |
|
CVE-2026-77170
The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission t...
|
4.3 Medium | — | 0,27% | 18 Sep 2026 |
|
CVE-2026-77169
A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass...
|
6.5 Medium | — | 0,47% | 18 Sep 2026 |
|
CVE-2026-77164
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/pr...
|
6.2 Medium | — | 0,19% | 18 Sep 2026 |
|
CVE-2026-68493
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.
|
3.1 Low | — | 0,23% | 18 Sep 2026 |
|
CVE-2026-93312
A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null point...
|
4.3 Medium | — | 0,40% | 18 Sep 2026 |
|
CVE-2026-93311
A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the compo...
|
4.3 Medium | — | 0,56% | 18 Sep 2026 |
|
CVE-2026-93310
A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resour...
|
5.3 Medium | — | 0,70% | 18 Sep 2026 |
|
CVE-2026-79954
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS...
|
8.7 High | — | 0,56% | 18 Sep 2026 |
|
CVE-2026-93454
Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create...
|
5.4 Medium | — | 0,30% | 18 Sep 2026 |
|
CVE-2026-93453
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery toke...
|
8.3 High | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-93452
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attac...
|
7.5 High | — | 0,68% | 18 Sep 2026 |
|
CVE-2026-93451
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length...
|
6.5 Medium | — | 0,50% | 18 Sep 2026 |