Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-89255
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode P...
|
8.7 High | — | 0,37% | 11 Sep 2026 |
|
CVE-2026-89244
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCa...
|
6.1 Medium | — | 0,26% | 11 Sep 2026 |
|
CVE-2026-89245
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to del...
|
6.5 Medium | — | 0,17% | 11 Sep 2026 |
|
CVE-2026-89246
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to s...
|
5.4 Medium | — | 0,24% | 11 Sep 2026 |
|
CVE-2026-89247
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD_Server/VMAP.php, which is reachable withou...
|
6.1 Medium | — | 0,36% | 11 Sep 2026 |
|
CVE-2026-89248
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin i...
|
5.3 Medium | — | 0,50% | 11 Sep 2026 |
|
CVE-2026-89249
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWall...
|
8.7 High | — | 0,37% | 11 Sep 2026 |
|
CVE-2026-89148
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php script, AVi...
|
5.4 Medium | — | 0,16% | 11 Sep 2026 |
|
CVE-2026-89239
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function that insert...
|
6.1 Medium | — | 0,26% | 11 Sep 2026 |
|
CVE-2026-89240
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The sc...
|
6.1 Medium | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-89241
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUEST...
|
6.1 Medium | — | 0,26% | 11 Sep 2026 |
|
CVE-2026-89242
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetches remote...
|
7.2 High | — | 0,28% | 11 Sep 2026 |
|
CVE-2026-89243
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fails to sani...
|
8.1 High | — | 0,38% | 11 Sep 2026 |
|
CVE-2026-87776
compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent...
|
7.5 High | — | 0,48% | 11 Sep 2026 |
|
CVE-2026-86793
SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed be...
|
9.8 Critical | — | 0,77% | 11 Sep 2026 |
|
CVE-2024-12145
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_ma...
|
4.3 Medium | — | 0,19% | 11 Sep 2026 |
|
CVE-2026-89147
Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on ne...
|
7.5 High | — | 0,49% | 11 Sep 2026 |
|
CVE-2026-89146
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious re...
|
7.5 High | — | 0,63% | 11 Sep 2026 |
|
CVE-2026-86809
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transa...
|
5.3 Medium | — | 0,16% | 11 Sep 2026 |
|
CVE-2026-86813
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowi...
|
4.8 Medium | — | 0,24% | 11 Sep 2026 |
|
CVE-2026-85116
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including th...
|
6.5 Medium | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-82215
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on t...
|
5.9 Medium | — | 0,16% | 11 Sep 2026 |
|
CVE-2026-82213
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticate...
|
5.3 Medium | — | 0,32% | 11 Sep 2026 |
|
CVE-2026-77159
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for sy...
|
5.5 Medium | — | 0,16% | 11 Sep 2026 |
|
CVE-2026-87123
hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsy...
|
5.9 Medium | — | 0,41% | 11 Sep 2026 |
|
CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimi...
|
5.3 Medium | — | 0,41% | 11 Sep 2026 |
|
CVE-2026-47839
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGr...
|
9.2 Critical | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-17037
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versi...
|
7.2 High | — | 0,19% | 11 Sep 2026 |
|
CVE-2026-87727
a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected pro...
|
6.9 Medium | — | 0,41% | 11 Sep 2026 |
|
CVE-2026-80469
An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggeri...
|
8.3 High | — | 0,39% | 11 Sep 2026 |
|
CVE-2026-19486
A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allo...
|
8.7 High | — | 0,27% | 11 Sep 2026 |
|
CVE-2025-15679
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.
|
7.3 High | — | 0,11% | 11 Sep 2026 |
|
CVE-2026-89179
WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the same netwo...
|
4.3 Medium | — | 0,16% | 11 Sep 2026 |
|
CVE-2026-89173
Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate vali...
|
5.3 Medium | — | 0,44% | 11 Sep 2026 |
|
CVE-2026-89174
Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain ac...
|
7.5 High | — | 0,51% | 11 Sep 2026 |
|
CVE-2026-89175
Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass auth...
|
5.3 Medium | — | 0,54% | 11 Sep 2026 |
|
CVE-2026-89176
WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network...
|
8.8 High | — | 0,40% | 11 Sep 2026 |
|
CVE-2026-89177
WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated...
|
8.8 High | — | 0,36% | 11 Sep 2026 |
|
CVE-2026-89178
WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoo...
|
8.8 High | — | 0,36% | 11 Sep 2026 |
|
CVE-2026-6642
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and inclu...
|
6.4 Medium | — | 0,36% | 11 Sep 2026 |
|
CVE-2026-6641
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to and including 3.35. This i...
|
6.4 Medium | — | 0,36% | 11 Sep 2026 |
|
CVE-2026-6640
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all versions up to, and including...
|
6.4 Medium | — | 0,42% | 11 Sep 2026 |
|
CVE-2026-87908
multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount...
|
7.5 High | — | 0,51% | 11 Sep 2026 |
|
CVE-2026-86779
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownersh...
|
2.7 Low | — | 0,28% | 11 Sep 2026 |
|
CVE-2026-86780
The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a...
|
6.8 Medium | — | 0,43% | 11 Sep 2026 |
|
CVE-2026-86781
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routin...
|
5.3 Medium | — | 0,18% | 11 Sep 2026 |
|
CVE-2026-86782
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publ...
|
5.5 Medium | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-86812
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an inc...
|
6.5 Medium | — | 0,27% | 11 Sep 2026 |
|
CVE-2026-86815
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution manageme...
|
5.5 Medium | — | 0,38% | 11 Sep 2026 |
|
CVE-2026-85677
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the s...
|
8.8 High | — | 0,51% | 11 Sep 2026 |