Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-78295
Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions.
|
8.8 High | — | 0,20% | 17 Sep 2026 |
|
CVE-2026-78294
Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-78223
Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation...
|
6.9 Medium | — | 0,44% | 17 Sep 2026 |
|
CVE-2026-74017
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
|
5.3 Medium | — | 0,31% | 17 Sep 2026 |
|
CVE-2026-74005
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
|
5.4 Medium | — | 0,14% | 17 Sep 2026 |
|
CVE-2026-74002
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
|
5.3 Medium | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-74000
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
|
5.3 Medium | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-73999
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
|
5.4 Medium | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-71568
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which red...
|
5.3 Medium | — | 0,23% | 17 Sep 2026 |
|
CVE-2026-66676
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
|
5.3 Medium | — | 0,31% | 17 Sep 2026 |
|
CVE-2026-66631
Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66630
Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66628
Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66626
Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66625
Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66624
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66619
Administrator SQL Injection in Newsletters <= 4.18 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66618
Administrator SQL Injection in WP Maps <= 4.9.9 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66617
Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66608
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
|
6.4 Medium | — | 0,23% | 17 Sep 2026 |
|
CVE-2026-66580
Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.
|
8.5 High | — | 0,36% | 17 Sep 2026 |
|
CVE-2026-66579
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66578
Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66577
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66576
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66575
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
|
5.3 Medium | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-66574
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66573
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66572
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66571
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.
|
7.1 High | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-62108
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.
|
9.8 Critical | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-62104
Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.
|
10.0 Critical | — | 0,86% | 17 Sep 2026 |
|
CVE-2026-62101
Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.
|
9.8 Critical | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-14850
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this pr...
|
8.8 High | — | 0,30% | 17 Sep 2026 |
|
CVE-2026-92932
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetc...
|
5.1 Medium | — | 0,39% | 17 Sep 2026 |
|
CVE-2026-92921
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can rec...
|
4.9 Medium | — | 0,30% | 17 Sep 2026 |
|
CVE-2026-92920
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Att...
|
5.4 Medium | — | 0,32% | 17 Sep 2026 |
|
CVE-2026-92919
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows de...
|
8.1 High | — | 0,58% | 17 Sep 2026 |
|
CVE-2026-92918
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the...
|
8.8 High | — | 0,65% | 17 Sep 2026 |
|
CVE-2026-92904
A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID w...
|
4.3 Medium | — | 0,34% | 17 Sep 2026 |
|
CVE-2026-81481
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability...
|
7.5 High | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-92925
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying exte...
|
7.1 High | — | 0,40% | 17 Sep 2026 |
|
CVE-2026-92917
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode,...
|
7.5 High | — | 0,46% | 17 Sep 2026 |
|
CVE-2026-92916
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default),...
|
7.5 High | — | 0,50% | 17 Sep 2026 |
|
CVE-2026-92915
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login re...
|
7.3 High | — | 0,42% | 17 Sep 2026 |
|
CVE-2026-92914
AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against a...
|
8.1 High | — | 0,48% | 17 Sep 2026 |
|
CVE-2026-92913
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairi...
|
7.4 High | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-92912
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to appr...
|
6.5 Medium | — | 0,31% | 17 Sep 2026 |
|
CVE-2026-92860
A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of...
|
9.1 Critical | — | 0,85% | 17 Sep 2026 |
|
CVE-2026-90823
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An una...
|
9.8 Critical | — | 0,68% | 17 Sep 2026 |