Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-27563
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credenti...
|
7.2 High | — | 2,7% | 16 Sep 2026 |
|
CVE-2026-27562
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials a...
|
7.2 High | — | 2,7% | 16 Sep 2026 |
|
CVE-2026-27561
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials a...
|
7.2 High | — | 2,7% | 16 Sep 2026 |
|
CVE-2026-27560
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credential...
|
7.2 High | — | 2,7% | 16 Sep 2026 |
|
CVE-2026-27559
A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials all...
|
8.8 High | — | 2,9% | 16 Sep 2026 |
|
CVE-2026-27558
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using opera...
|
8.8 High | — | 2,9% | 16 Sep 2026 |
|
CVE-2026-27557
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to...
|
7.5 High | — | 0,71% | 16 Sep 2026 |
|
CVE-2026-27556
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allow...
|
8.8 High | — | 0,89% | 16 Sep 2026 |
|
CVE-2026-27555
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing ex...
|
8.8 High | — | 0,89% | 16 Sep 2026 |
|
CVE-2026-27554
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing ex...
|
8.8 High | — | 2,9% | 16 Sep 2026 |
|
CVE-2026-27553
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowi...
|
6.5 Medium | — | 0,56% | 16 Sep 2026 |
|
CVE-2026-27552
A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentia...
|
8.1 High | — | 0,60% | 16 Sep 2026 |
|
CVE-2026-27551
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution o...
|
8.8 High | — | 2,9% | 16 Sep 2026 |
|
CVE-2026-27550
A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of command...
|
8.8 High | — | 2,9% | 16 Sep 2026 |
|
CVE-2026-27549
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowi...
|
8.8 High | — | 2,9% | 16 Sep 2026 |
|
CVE-2026-27548
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allow...
|
8.8 High | — | 2,9% | 16 Sep 2026 |
|
CVE-2026-27547
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials...
|
8.8 High | — | 2,9% | 16 Sep 2026 |
|
CVE-2026-27546
An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.
|
9.8 Critical | — | 1,0% | 16 Sep 2026 |
|
CVE-2026-86475
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, all...
|
5.3 Medium | — | 0,31% | 16 Sep 2026 |
|
CVE-2026-84906
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway re...
|
5.3 Medium | — | 0,16% | 16 Sep 2026 |
|
CVE-2026-8030
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions co...
|
4.3 Medium | — | 0,51% | 16 Sep 2026 |
|
CVE-2026-79708
gitlab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions coul...
|
8.5 High | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-78252
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions,...
|
6.1 Medium | — | 0,27% | 16 Sep 2026 |
|
CVE-2026-7514
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with...
|
4.3 Medium | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-73447
A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can explo...
|
9.1 Critical | — | 0,71% | 16 Sep 2026 |
|
CVE-2026-3855
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions...
|
6.8 Medium | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-19857
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported to...
|
4.8 Medium | — | 0,19% | 16 Sep 2026 |
|
CVE-2026-19619
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions co...
|
4.7 Medium | — | 0,24% | 16 Sep 2026 |
|
CVE-2026-1168
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions...
|
7.5 High | — | 0,49% | 16 Sep 2026 |
|
CVE-2026-19248
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
|
7.1 High | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-16794
gitlab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions coul...
|
4.3 Medium | — | 0,31% | 16 Sep 2026 |
|
CVE-2026-13407
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the bo...
|
5.4 Medium | — | 0,22% | 16 Sep 2026 |
|
CVE-2025-14871
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions...
|
7.5 High | — | 0,50% | 16 Sep 2026 |
|
CVE-2024-11222
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions co...
|
6.4 Medium | — | 0,29% | 16 Sep 2026 |
|
CVE-2026-92358
A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to val...
|
6.4 Medium | — | 0,27% | 16 Sep 2026 |
|
CVE-2026-89328
The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations...
|
3.8 Low | — | 0,26% | 16 Sep 2026 |
|
CVE-2026-89327
The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board mem...
|
3.8 Low | — | 0,26% | 16 Sep 2026 |
|
CVE-2026-88910
The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uplo...
|
5.3 Medium | — | 0,30% | 16 Sep 2026 |
|
CVE-2026-87959
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber...
|
5.4 Medium | — | 0,23% | 16 Sep 2026 |
|
CVE-2026-87907
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, all...
|
5.3 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-87896
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing u...
|
5.3 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-87860
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make...
|
4.3 Medium | — | 0,17% | 16 Sep 2026 |
|
CVE-2026-87854
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticat...
|
5.3 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-87828
The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such...
|
5.7 Medium | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-86823
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated att...
|
5.3 Medium | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-86784
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowin...
|
6.8 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-86449
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowin...
|
5.3 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-86448
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allo...
|
3.7 Low | — | 0,31% | 16 Sep 2026 |
|
CVE-2026-86447
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list...
|
5.3 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-86445
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to...
|
5.3 Medium | — | 0,35% | 16 Sep 2026 |