Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-71646
An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the FastExplora...
|
7.5 High | — | 0,49% | 11 Sep 2026 |
|
CVE-2026-62136
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.
|
5.3 Medium | — | 0,29% | 11 Sep 2026 |
|
CVE-2026-62137
Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.
|
5.3 Medium | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-62138
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.
|
6.5 Medium | — | 0,22% | 11 Sep 2026 |
|
CVE-2026-62139
Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.
|
4.3 Medium | — | 0,10% | 11 Sep 2026 |
|
CVE-2026-62140
Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.
|
5.3 Medium | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-62112
Editor SQL Injection in Amelia <= 2.4.9 versions.
|
7.6 High | — | 0,38% | 11 Sep 2026 |
|
CVE-2026-62113
Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.
|
4.3 Medium | — | 0,27% | 11 Sep 2026 |
|
CVE-2026-62114
Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.
|
5.3 Medium | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-62132
Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.
|
5.3 Medium | — | 0,29% | 11 Sep 2026 |
|
CVE-2026-62133
Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.
|
5.4 Medium | — | 0,14% | 11 Sep 2026 |
|
CVE-2026-62134
Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.
|
4.3 Medium | — | 0,25% | 11 Sep 2026 |
|
CVE-2026-62135
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
|
5.3 Medium | — | 0,29% | 11 Sep 2026 |
|
CVE-2026-62102
Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions.
|
8.8 High | — | 0,42% | 11 Sep 2026 |
|
CVE-2026-62103
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
|
9.8 Critical | — | 0,56% | 11 Sep 2026 |
|
CVE-2026-62105
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
|
9.8 Critical | — | 0,56% | 11 Sep 2026 |
|
CVE-2026-62106
Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.
|
8.8 High | — | 0,42% | 11 Sep 2026 |
|
CVE-2026-62107
Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.
|
8.8 High | — | 0,52% | 11 Sep 2026 |
|
CVE-2026-62109
Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions.
|
7.6 High | — | 0,38% | 11 Sep 2026 |
|
CVE-2026-62110
Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.
|
6.5 Medium | — | 0,22% | 11 Sep 2026 |
|
CVE-2026-62111
Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.
|
6.5 Medium | — | 0,22% | 11 Sep 2026 |
|
CVE-2026-62088
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data.
This issue affects ElasticPress: from n/a t...
|
5.3 Medium | — | 0,33% | 11 Sep 2026 |
|
CVE-2026-62089
Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse.
This issue affects Master Addons for Elementor: from n/a through 3....
|
7.1 High | — | 0,32% | 11 Sep 2026 |
|
CVE-2026-54072
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without...
|
9.3 Critical | — | 0,46% | 11 Sep 2026 |
|
CVE-2026-27378
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.
|
5.3 Medium | — | 0,29% | 11 Sep 2026 |
|
CVE-2025-69904
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Success...
|
4.9 Medium | — | 0,35% | 11 Sep 2026 |
|
CVE-2026-9160
Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection.
This issue affects...
|
4.3 Medium | — | 0,28% | 11 Sep 2026 |
|
CVE-2026-89090
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the...
|
5.9 Medium | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-89099
mongodb
A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading...
|
7.5 High | — | 0,32% | 11 Sep 2026 |
|
CVE-2026-87910
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice...
|
5.7 Medium | — | 0,50% | 11 Sep 2026 |
|
CVE-2026-82535
Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into s...
|
6.1 Medium | — | 0,47% | 11 Sep 2026 |
|
CVE-2026-82617
apache opennlp
The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL
and DEFAULT_REGEX_NAME_FINDER.URL - conta...
|
9.8 Critical | — | 0,77% | 11 Sep 2026 |
|
CVE-2026-81908
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Gro...
|
6.0 Medium | — | 0,39% | 11 Sep 2026 |
|
CVE-2026-81909
Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php).It does...
|
5.9 Medium | — | 0,44% | 11 Sep 2026 |
|
CVE-2026-78807
An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation...
|
7.1 High | — | 0,08% | 11 Sep 2026 |
|
CVE-2026-7298
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Re...
|
6.1 Medium | — | 0,25% | 11 Sep 2026 |
|
CVE-2026-68528
Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able t...
|
6.0 Medium | — | 0,38% | 11 Sep 2026 |
|
CVE-2026-67211
apache opennlp
OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer
Versions Affected:
- 3.0.0-M4
- 3.0.0-M5
(The opennlp-spellcheck extensio...
|
7.5 High | — | 0,74% | 11 Sep 2026 |
|
CVE-2026-18495
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF file...
|
6.1 Medium | — | 0,12% | 11 Sep 2026 |
|
CVE-2026-18122
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collect...
|
6.0 Medium | — | 0,23% | 11 Sep 2026 |
|
CVE-2026-72709
SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privil...
|
9.8 Critical | — | 0,66% | 11 Sep 2026 |
|
CVE-2026-72710
SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lack...
|
9.8 Critical | — | 1,1% | 11 Sep 2026 |
|
CVE-2026-72708
SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL b...
|
7.5 High | — | 0,52% | 11 Sep 2026 |
|
CVE-2026-54047
Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerabil...
|
9.2 Critical | — | 0,30% | 11 Sep 2026 |
|
CVE-2026-18061
amazon advanced jdbc wrapper
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write acce...
|
5.9 Medium | — | 0,27% | 11 Sep 2026 |
|
CVE-2026-89263
MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications...
|
5.3 Medium | — | 0,45% | 11 Sep 2026 |
|
CVE-2026-89264
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any...
|
4.3 Medium | — | 0,37% | 11 Sep 2026 |
|
CVE-2026-89265
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation req...
|
4.3 Medium | — | 0,37% | 11 Sep 2026 |
|
CVE-2026-8304
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Control Securi...
|
5.5 Medium | — | 0,14% | 11 Sep 2026 |
|
CVE-2026-89260
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method...
|
7.5 High | — | 0,73% | 11 Sep 2026 |