Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-86447
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list...
|
5.3 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-86445
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to...
|
5.3 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-86444
The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attack...
|
7.1 High | — | 0,28% | 16 Sep 2026 |
|
CVE-2026-85641
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifi...
|
4.3 Medium | — | 0,14% | 16 Sep 2026 |
|
CVE-2026-85572
The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated...
|
4.3 Medium | — | 0,30% | 16 Sep 2026 |
|
CVE-2026-85569
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permissio...
|
7.2 High | — | 0,46% | 16 Sep 2026 |
|
CVE-2026-85530
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that...
|
8.1 High | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-85349
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated us...
|
4.3 Medium | — | 0,30% | 16 Sep 2026 |
|
CVE-2026-85131
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not...
|
6.5 Medium | — | 0,20% | 16 Sep 2026 |
|
CVE-2026-84907
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is...
|
3.7 Low | — | 0,25% | 16 Sep 2026 |
|
CVE-2026-84905
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and...
|
2.7 Low | — | 0,28% | 16 Sep 2026 |
|
CVE-2026-84829
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated user...
|
8.8 High | — | 0,51% | 16 Sep 2026 |
|
CVE-2026-84088
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript...
|
6.8 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-82126
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for,...
|
2.7 Low | — | 0,30% | 16 Sep 2026 |
|
CVE-2026-82125
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its...
|
5.3 Medium | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-82124
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured...
|
5.3 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-78474
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing u...
|
5.3 Medium | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-78472
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users...
|
8.6 High | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-77702
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing u...
|
5.3 Medium | — | 0,30% | 16 Sep 2026 |
|
CVE-2026-76559
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import...
|
4.1 Medium | — | 0,30% | 16 Sep 2026 |
|
CVE-2026-76558
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its a...
|
6.8 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-76557
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allow...
|
6.8 Medium | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-76556
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing use...
|
6.8 Medium | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-76555
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory...
|
6.8 Medium | — | 0,47% | 16 Sep 2026 |
|
CVE-2026-76553
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resol...
|
6.5 Medium | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-76552
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, al...
|
8.8 High | — | 0,73% | 16 Sep 2026 |
|
CVE-2026-76551
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export p...
|
7.2 High | — | 0,82% | 16 Sep 2026 |
|
CVE-2026-76550
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permis...
|
7.2 High | — | 0,82% | 16 Sep 2026 |
|
CVE-2026-74926
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated u...
|
7.1 High | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-89063
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including,...
|
7.5 High | — | 1,6% | 16 Sep 2026 |
|
CVE-2026-5920
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode in all vers...
|
6.4 Medium | — | 0,28% | 16 Sep 2026 |
|
CVE-2026-18555
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter...
|
6.1 Medium | — | 0,23% | 16 Sep 2026 |
|
CVE-2026-78088
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all version...
|
8.8 High | — | 0,79% | 16 Sep 2026 |
|
CVE-2026-18595
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including...
|
7.2 High | — | 0,25% | 16 Sep 2026 |
|
CVE-2026-16588
The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to insufficien...
|
6.5 Medium | — | 0,29% | 16 Sep 2026 |
|
CVE-2026-14349
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is...
|
9.8 Critical | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-12793
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to th...
|
9.8 Critical | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-11996
The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due...
|
6.4 Medium | — | 0,21% | 16 Sep 2026 |
|
CVE-2026-11984
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capabi...
|
5.3 Medium | — | 0,29% | 16 Sep 2026 |
|
CVE-2026-92247
A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component...
|
4.7 Medium | — | 0,40% | 16 Sep 2026 |
|
CVE-2026-92221
A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generate_i...
|
4.7 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-92220
A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_finished/MoRIIO...
|
5.3 Medium | — | 0,70% | 16 Sep 2026 |
|
CVE-2026-86109
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algor...
|
6.6 Medium | — | 0,24% | 16 Sep 2026 |
|
CVE-2026-86108
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configurat...
|
8.0 High | — | 0,61% | 16 Sep 2026 |
|
CVE-2026-73450
On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segmen...
|
6.9 Medium | — | 0,16% | 16 Sep 2026 |
|
CVE-2026-92299
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting p...
|
7.4 High | — | 0,48% | 16 Sep 2026 |
|
CVE-2026-92298
EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure ge...
|
4.8 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92217
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-pro...
|
6.3 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92216
A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-bind...
|
4.3 Medium | — | 0,49% | 16 Sep 2026 |
|
CVE-2026-92215
A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agent_sdks/python/a2ui_agent/src/a2...
|
7.3 High | — | 0,51% | 16 Sep 2026 |