Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-78425
Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they le...
|
7.6 High | — | 0,36% | 17 Sep 2026 |
|
CVE-2026-50610
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged...
|
7.4 High | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-50609
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged N...
|
7.4 High | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-50608
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly...
|
1.2 Low | — | 0,21% | 17 Sep 2026 |
|
CVE-2026-15688
Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully aut...
|
9.2 Critical | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-87831
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it,...
|
4.3 Medium | — | 0,25% | 17 Sep 2026 |
|
CVE-2026-87829
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it,...
|
4.3 Medium | — | 0,25% | 17 Sep 2026 |
|
CVE-2026-86320
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source con...
|
7.8 High | — | 0,24% | 17 Sep 2026 |
|
CVE-2026-50607
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on al...
|
2.7 Low | — | 0,43% | 17 Sep 2026 |
|
CVE-2026-50606
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-c...
|
1.2 Low | — | 0,10% | 17 Sep 2026 |
|
CVE-2026-50605
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged servi...
|
7.4 High | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-91017
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferr...
|
3.7 Low | — | 0,14% | 17 Sep 2026 |
|
CVE-2026-90982
@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows...
|
5.3 Medium | — | 0,59% | 17 Sep 2026 |
|
CVE-2026-87963
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPr...
|
8.6 High | — | 0,45% | 17 Sep 2026 |
|
CVE-2026-86801
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability...
|
8.8 High | — | 0,51% | 17 Sep 2026 |
|
CVE-2026-44940
The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. A...
|
5.7 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-91019
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Cont...
|
4.9 Medium | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-91016
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthent...
|
5.3 Medium | — | 0,32% | 17 Sep 2026 |
|
CVE-2026-91015
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relyi...
|
5.3 Medium | — | 0,30% | 17 Sep 2026 |
|
CVE-2026-91014
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the pag...
|
7.1 High | — | 0,28% | 17 Sep 2026 |
|
CVE-2026-91011
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with aut...
|
6.8 Medium | — | 0,43% | 17 Sep 2026 |
|
CVE-2026-91010
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX...
|
4.3 Medium | — | 0,25% | 17 Sep 2026 |
|
CVE-2026-91009
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowin...
|
4.3 Medium | — | 0,14% | 17 Sep 2026 |
|
CVE-2026-91008
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation detail...
|
3.7 Low | — | 0,26% | 17 Sep 2026 |
|
CVE-2026-90923
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored...
|
6.5 Medium | — | 0,27% | 17 Sep 2026 |
|
CVE-2026-90922
The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment b...
|
5.3 Medium | — | 0,30% | 17 Sep 2026 |
|
CVE-2026-88904
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the reques...
|
8.8 High | — | 0,42% | 17 Sep 2026 |
|
CVE-2026-88795
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and c...
|
9.0 Critical | — | 0,81% | 17 Sep 2026 |
|
CVE-2026-88792
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenti...
|
8.8 High | — | 0,51% | 17 Sep 2026 |
|
CVE-2026-87836
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned...
|
2.7 Low | — | 0,32% | 17 Sep 2026 |
|
CVE-2026-87786
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthe...
|
8.8 High | — | 0,51% | 17 Sep 2026 |
|
CVE-2026-86824
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash,...
|
4.8 Medium | — | 0,15% | 17 Sep 2026 |
|
CVE-2026-86788
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and bloc...
|
6.8 Medium | — | 0,43% | 17 Sep 2026 |
|
CVE-2026-86710
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, wh...
|
9.8 Critical | — | 0,50% | 17 Sep 2026 |
|
CVE-2026-86709
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log i...
|
9.8 Critical | — | 0,63% | 17 Sep 2026 |
|
CVE-2026-86707
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata val...
|
9.8 Critical | — | 0,50% | 17 Sep 2026 |
|
CVE-2026-86446
The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obta...
|
3.7 Low | — | 0,28% | 17 Sep 2026 |
|
CVE-2026-85130
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an...
|
8.8 High | — | 0,51% | 17 Sep 2026 |
|
CVE-2026-85128
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer,...
|
7.5 High | — | 0,32% | 17 Sep 2026 |
|
CVE-2025-15697
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthe...
|
7.1 High | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-87935
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is...
|
8.1 High | — | 0,91% | 17 Sep 2026 |
|
CVE-2026-87796
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. T...
|
9.8 Critical | — | 1,1% | 17 Sep 2026 |
|
CVE-2026-50604
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require...
|
4.9 Medium | — | 0,21% | 17 Sep 2026 |
|
CVE-2026-25294
qualcomm cologne firmware, qualcomm congo firmware +58 lainnya
Transient DOS while parsing frame during channel usage.
|
7.4 High | — | 0,10% | 17 Sep 2026 |
|
CVE-2026-25290
qualcomm cologne firmware, qualcomm fastconnect 7800 firmware +5 lainnya
Memory Corruption when validating large data buffers from external sources using addition to check buffer length.
|
7.8 High | — | 0,07% | 17 Sep 2026 |
|
CVE-2026-25284
qualcomm cologne firmware, qualcomm fastconnect 7800 firmware +5 lainnya
Information Disclosure when a pointer is reused after being deallocated.
|
7.3 High | — | 0,07% | 17 Sep 2026 |
|
CVE-2026-25283
qualcomm cologne firmware, qualcomm fastconnect 7800 firmware +5 lainnya
Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.
|
8.8 High | — | 0,07% | 17 Sep 2026 |
|
CVE-2026-25282
qualcomm cologne firmware, qualcomm fastconnect 7800 firmware +5 lainnya
Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.
|
7.9 High | — | 0,06% | 17 Sep 2026 |
|
CVE-2026-25281
qualcomm cologne firmware, qualcomm fastconnect 7800 firmware +5 lainnya
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.
|
7.4 High | — | 0,10% | 17 Sep 2026 |
|
CVE-2026-25280
qualcomm wsa8845h firmware, qualcomm cologne firmware +18 lainnya
Memory corruption when processing escape handling flow with insufficient user buffer sizes.
|
7.8 High | — | 0,07% | 17 Sep 2026 |