Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-82845
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users wi...
|
9.9 Critical | — | 0,64% | 12 Sep 2026 |
|
CVE-2026-82847
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with...
|
6.8 Medium | — | 0,43% | 12 Sep 2026 |
|
CVE-2026-82851
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the...
|
2.7 Low | — | 0,30% | 12 Sep 2026 |
|
CVE-2026-81742
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does n...
|
8.8 High | — | 0,51% | 12 Sep 2026 |
|
CVE-2026-81090
The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to...
|
7.2 High | — | 0,37% | 12 Sep 2026 |
|
CVE-2026-81402
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing un...
|
9.8 Critical | — | 0,81% | 12 Sep 2026 |
|
CVE-2026-81429
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported...
|
7.1 High | — | 0,13% | 12 Sep 2026 |
|
CVE-2026-80491
The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing...
|
8.6 High | — | 0,45% | 12 Sep 2026 |
|
CVE-2026-80494
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any...
|
8.6 High | — | 0,43% | 12 Sep 2026 |
|
CVE-2026-77752
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before gran...
|
7.2 High | — | 0,46% | 12 Sep 2026 |
|
CVE-2026-77753
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when t...
|
5.5 Medium | — | 0,32% | 12 Sep 2026 |
|
CVE-2026-78152
The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default...
|
5.3 Medium | — | 0,33% | 12 Sep 2026 |
|
CVE-2026-77689
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trus...
|
5.3 Medium | — | 0,30% | 12 Sep 2026 |
|
CVE-2026-77705
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify...
|
7.2 High | — | 0,46% | 12 Sep 2026 |
|
CVE-2026-77005
The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the us...
|
9.6 Critical | — | 0,43% | 12 Sep 2026 |
|
CVE-2026-77006
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards...
|
9.6 Critical | — | 0,25% | 12 Sep 2026 |
|
CVE-2026-75800
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unau...
|
9.8 Critical | — | 0,63% | 12 Sep 2026 |
|
CVE-2026-87719
Advisory
gitlab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before...
|
9.9 Critical | — | 0,57% | 12 Sep 2026 |
|
CVE-2026-85706
Advisory
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 befo...
|
10.0 Critical | KEV | 92,0% | 12 Sep 2026 |
|
CVE-2026-89268
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can in...
|
5.4 Medium | — | 0,30% | 12 Sep 2026 |
|
CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command l...
|
4.0 Medium | — | 0,39% | 12 Sep 2026 |
|
CVE-2026-89267
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on...
|
4.3 Medium | — | 0,33% | 12 Sep 2026 |
|
CVE-2026-89266
stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can...
|
8.2 High | — | 0,64% | 12 Sep 2026 |
|
CVE-2026-90457
The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that ha...
|
6.2 Medium | — | 0,09% | 11 Sep 2026 |
|
CVE-2026-90460
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access...
|
7.6 High | — | 0,57% | 11 Sep 2026 |
|
CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
|
6.3 Medium | — | 0,36% | 11 Sep 2026 |
|
CVE-2026-90449
When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface wit...
|
6.5 Medium | — | 0,20% | 11 Sep 2026 |
|
CVE-2026-90450
The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaul...
|
4.3 Medium | — | 0,18% | 11 Sep 2026 |
|
CVE-2026-90451
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A d...
|
5.9 Medium | — | 0,25% | 11 Sep 2026 |
|
CVE-2026-90452
Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server...
|
5.3 Medium | — | 0,10% | 11 Sep 2026 |
|
CVE-2026-90453
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the appl...
|
3.5 Low | — | 0,15% | 11 Sep 2026 |
|
CVE-2026-90454
A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern...
|
4.3 Medium | — | 0,16% | 11 Sep 2026 |
|
CVE-2026-90455
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version...
|
3.7 Low | — | 0,20% | 11 Sep 2026 |
|
CVE-2026-90456
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copie...
|
8.1 High | — | 0,27% | 11 Sep 2026 |
|
CVE-2026-90443
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to re...
|
5.4 Medium | — | 0,18% | 11 Sep 2026 |
|
CVE-2026-90444
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later const...
|
8.8 High | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-90445
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the...
|
6.5 Medium | — | 0,33% | 11 Sep 2026 |
|
CVE-2026-90446
An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and a...
|
4.3 Medium | — | 0,17% | 11 Sep 2026 |
|
CVE-2026-90447
A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than...
|
6.5 Medium | — | 0,22% | 11 Sep 2026 |
|
CVE-2026-90448
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods a...
|
6.5 Medium | — | 0,18% | 11 Sep 2026 |
|
CVE-2026-54240
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HE...
|
7.4 High | — | 0,39% | 11 Sep 2026 |
|
CVE-2026-54241
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buf...
|
7.4 High | — | 0,39% | 11 Sep 2026 |
|
CVE-2026-54248
Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-bo...
|
6.5 Medium | — | 0,40% | 11 Sep 2026 |
|
CVE-2026-54258
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged use...
|
6.5 Medium | — | 0,34% | 11 Sep 2026 |
|
CVE-2026-45056
matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to vers...
|
6.9 Medium | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-49846
libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has m...
|
7.5 High | — | 0,50% | 11 Sep 2026 |
|
CVE-2026-49992
Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcu...
|
6.3 Medium | — | 0,22% | 11 Sep 2026 |
|
CVE-2026-50013
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDi...
|
7.5 High | — | 0,47% | 11 Sep 2026 |
|
CVE-2026-50018
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the re...
|
6.5 Medium | — | 0,54% | 11 Sep 2026 |
|
CVE-2026-48496
OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to vers...
|
6.2 Medium | — | 0,14% | 11 Sep 2026 |