Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-90552
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.p...
|
4.3 Medium | — | 0,36% | 12 Sep 2026 |
|
CVE-2026-90553
vllm
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote...
|
7.8 High | — | 0,31% | 12 Sep 2026 |
|
CVE-2026-90540
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to pl...
|
4.3 Medium | — | 0,26% | 12 Sep 2026 |
|
CVE-2026-90541
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticate...
|
5.3 Medium | — | 0,41% | 12 Sep 2026 |
|
CVE-2026-90542
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindM...
|
5.4 Medium | — | 0,24% | 12 Sep 2026 |
|
CVE-2026-90543
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/s...
|
5.3 Medium | — | 0,60% | 12 Sep 2026 |
|
CVE-2026-90544
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating...
|
4.3 Medium | — | 0,26% | 12 Sep 2026 |
|
CVE-2026-90545
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authentica...
|
4.3 Medium | — | 0,30% | 12 Sep 2026 |
|
CVE-2026-90546
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-in users to...
|
4.3 Medium | — | 0,36% | 12 Sep 2026 |
|
CVE-2026-90533
flowiseai flowise
Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the orga...
|
6.5 Medium | — | 0,34% | 12 Sep 2026 |
|
CVE-2026-90534
flowiseai flowise
Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without a...
|
6.5 Medium | — | 0,37% | 12 Sep 2026 |
|
CVE-2026-90535
flowiseai flowise
Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowI...
|
7.5 High | — | 0,48% | 12 Sep 2026 |
|
CVE-2026-90536
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers to retrieve...
|
5.3 Medium | — | 0,41% | 12 Sep 2026 |
|
CVE-2026-90537
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unau...
|
8.2 High | — | 0,36% | 12 Sep 2026 |
|
CVE-2026-90538
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows unauthenticat...
|
5.3 Medium | — | 0,36% | 12 Sep 2026 |
|
CVE-2026-90539
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that...
|
5.3 Medium | — | 0,41% | 12 Sep 2026 |
|
CVE-2026-10148
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and in...
|
6.4 Medium | — | 0,24% | 12 Sep 2026 |
|
CVE-2026-15451
The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment v...
|
8.8 High | — | 0,24% | 12 Sep 2026 |
|
CVE-2026-90472
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth l...
|
5.3 Medium | — | 0,57% | 12 Sep 2026 |
|
CVE-2026-90473
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attacker...
|
5.3 Medium | — | 0,41% | 12 Sep 2026 |
|
CVE-2026-90474
MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and...
|
6.8 Medium | — | 0,55% | 12 Sep 2026 |
|
CVE-2026-89172
Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052.
This issue affects AN1044: through A; AN953: th...
|
5.6 Medium | — | 0,20% | 12 Sep 2026 |
|
CVE-2026-85198
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, a...
|
6.5 Medium | — | 0,47% | 12 Sep 2026 |
|
CVE-2026-85200
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader f...
|
7.5 High | — | 3,2% | 12 Sep 2026 |
|
CVE-2026-78006
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function....
|
9.8 Critical | — | 1,5% | 12 Sep 2026 |
|
CVE-2026-78159
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due...
|
9.8 Critical | — | 1,4% | 12 Sep 2026 |
|
CVE-2026-78175
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withd...
|
8.8 High | — | 1,1% | 12 Sep 2026 |
|
CVE-2026-77161
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24...
|
6.5 Medium | — | 0,45% | 12 Sep 2026 |
|
CVE-2026-17585
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in...
|
5.3 Medium | — | 0,32% | 12 Sep 2026 |
|
CVE-2026-16482
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to,...
|
7.5 High | — | 0,34% | 12 Sep 2026 |
|
CVE-2026-11355
The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers...
|
5.3 Medium | — | 0,25% | 12 Sep 2026 |
|
CVE-2026-87891
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticat...
|
6.5 Medium | — | 0,34% | 12 Sep 2026 |
|
CVE-2026-87892
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creatin...
|
5.3 Medium | — | 0,34% | 12 Sep 2026 |
|
CVE-2026-87894
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and eac...
|
5.3 Medium | — | 0,32% | 12 Sep 2026 |
|
CVE-2026-87916
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attac...
|
5.3 Medium | — | 0,35% | 12 Sep 2026 |
|
CVE-2026-87918
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allo...
|
5.3 Medium | — | 0,32% | 12 Sep 2026 |
|
CVE-2026-87919
The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's cap...
|
4.9 Medium | — | 0,33% | 12 Sep 2026 |
|
CVE-2026-87759
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a calle...
|
8.8 High | — | 0,42% | 12 Sep 2026 |
|
CVE-2026-87797
The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its...
|
4.3 Medium | — | 0,25% | 12 Sep 2026 |
|
CVE-2026-87842
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthe...
|
7.5 High | — | 0,50% | 12 Sep 2026 |
|
CVE-2026-87888
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber rol...
|
8.0 High | — | 0,41% | 12 Sep 2026 |
|
CVE-2026-84099
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricti...
|
8.1 High | — | 0,45% | 12 Sep 2026 |
|
CVE-2026-84171
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory,...
|
9.8 Critical | — | 0,67% | 12 Sep 2026 |
|
CVE-2026-86790
The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could...
|
6.8 Medium | — | 0,43% | 12 Sep 2026 |
|
CVE-2026-85681
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it tak...
|
9.8 Critical | — | 0,50% | 12 Sep 2026 |
|
CVE-2026-84023
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary t...
|
6.5 Medium | — | 0,17% | 12 Sep 2026 |
|
CVE-2026-84024
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by t...
|
4.3 Medium | — | 0,14% | 12 Sep 2026 |
|
CVE-2026-84025
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who a...
|
2.2 Low | — | 0,24% | 12 Sep 2026 |
|
CVE-2026-84047
The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to...
|
8.6 High | — | 0,45% | 12 Sep 2026 |
|
CVE-2026-83532
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users wit...
|
6.8 Medium | — | 0,43% | 12 Sep 2026 |