Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-85678
The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing us...
|
6.8 Medium | — | 0,43% | 11 Sep 2026 |
|
CVE-2026-83546
The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level a...
|
6.8 Medium | — | 0,43% | 11 Sep 2026 |
|
CVE-2026-83545
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-l...
|
6.8 Medium | — | 0,43% | 11 Sep 2026 |
|
CVE-2026-82305
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to renam...
|
5.3 Medium | — | 0,30% | 11 Sep 2026 |
|
CVE-2026-73784
A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user.
|
8.8 High | — | 0,30% | 11 Sep 2026 |
|
CVE-2026-73785
A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service (DoS).
|
7.5 High | — | 0,57% | 11 Sep 2026 |
|
CVE-2026-74925
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that r...
|
7.2 High | — | 0,46% | 11 Sep 2026 |
|
CVE-2026-14562
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the U...
|
5.3 Medium | — | 0,21% | 11 Sep 2026 |
|
CVE-2026-14563
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an una...
|
9.8 Critical | — | 0,28% | 11 Sep 2026 |
|
CVE-2026-14565
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product,...
|
5.4 Medium | — | 0,13% | 11 Sep 2026 |
|
CVE-2026-14566
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata...
|
4.3 Medium | — | 0,15% | 11 Sep 2026 |
|
CVE-2026-14559
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in a...
|
9.8 Critical | — | 0,28% | 11 Sep 2026 |
|
CVE-2026-14560
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the orig...
|
10.0 Critical | — | 0,44% | 11 Sep 2026 |
|
CVE-2026-13326
An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a craf...
|
6.9 Medium | — | 0,15% | 11 Sep 2026 |
|
CVE-2025-15695
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, al...
|
3.5 Low | — | 0,14% | 11 Sep 2026 |
|
CVE-2026-89060
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to...
|
7.7 High | — | 0,48% | 11 Sep 2026 |
|
CVE-2026-89162
pcre2
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already un...
|
3.3 Low | — | 0,16% | 11 Sep 2026 |
|
CVE-2026-89169
live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.
|
4.1 Medium | — | 0,15% | 11 Sep 2026 |
|
CVE-2026-89160
pcre2
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
|
6.5 Medium | — | 0,27% | 11 Sep 2026 |
|
CVE-2026-89161
pcre2
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
|
7.8 High | — | 0,13% | 11 Sep 2026 |
|
CVE-2026-8778
The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file...
|
9.8 Critical | — | 1,1% | 11 Sep 2026 |
|
CVE-2026-89156
pcre2
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
|
5.9 Medium | — | 0,29% | 11 Sep 2026 |
|
CVE-2026-89157
pcre2
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
|
7.4 High | — | 0,28% | 11 Sep 2026 |
|
CVE-2026-89158
pcre2
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
|
6.5 Medium | — | 0,25% | 11 Sep 2026 |
|
CVE-2026-84960
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due...
|
6.1 Medium | — | 0,37% | 11 Sep 2026 |
|
CVE-2026-81754
The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header i...
|
7.2 High | — | 0,42% | 11 Sep 2026 |
|
CVE-2026-81825
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including...
|
7.2 High | — | 0,49% | 11 Sep 2026 |
|
CVE-2026-7438
The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortc...
|
6.4 Medium | — | 0,36% | 11 Sep 2026 |
|
CVE-2026-78172
The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and includin...
|
6.1 Medium | — | 0,37% | 11 Sep 2026 |
|
CVE-2026-77150
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including,...
|
6.1 Medium | — | 0,45% | 11 Sep 2026 |
|
CVE-2026-19985
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post_types',...
|
6.1 Medium | — | 0,26% | 11 Sep 2026 |
|
CVE-2026-19991
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin s...
|
8.1 High | — | 0,41% | 11 Sep 2026 |
|
CVE-2026-18964
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross...
|
6.1 Medium | — | 0,22% | 11 Sep 2026 |
|
CVE-2026-18562
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segmen...
|
6.1 Medium | — | 0,23% | 11 Sep 2026 |
|
CVE-2026-18579
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9...
|
7.2 High | — | 0,29% | 11 Sep 2026 |
|
CVE-2026-18561
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is d...
|
7.5 High | — | 0,33% | 11 Sep 2026 |
|
CVE-2026-12215
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vuln...
|
5.3 Medium | — | 0,32% | 11 Sep 2026 |
|
CVE-2026-15462
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versi...
|
7.5 High | — | 0,30% | 11 Sep 2026 |
|
CVE-2026-11496
The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up...
|
6.5 Medium | — | 0,26% | 11 Sep 2026 |
|
CVE-2026-11446
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and...
|
5.3 Medium | — | 0,24% | 11 Sep 2026 |
|
CVE-2026-88260
Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Re...
|
8.7 High | — | 0,32% | 11 Sep 2026 |
|
CVE-2026-89151
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
|
3.5 Low | — | 0,23% | 11 Sep 2026 |
|
CVE-2026-78135
strongswan
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an au...
|
7.3 High | — | 0,42% | 11 Sep 2026 |
|
CVE-2026-88914
A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer ove...
|
4.4 Medium | — | 0,12% | 11 Sep 2026 |
|
CVE-2026-89092
The nscd service in the GNU C Library 2.3.4 onwards may crash due to a
stack overflow when a malicious DNS server returns too large a response
for a DNS query, resultin...
|
4.2 Medium | — | 0,24% | 11 Sep 2026 |
|
CVE-2026-89145
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attac...
|
4.2 Medium | — | 0,18% | 11 Sep 2026 |
|
CVE-2026-78127
strongswan
libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.
|
3.7 Low | — | 0,41% | 11 Sep 2026 |
|
CVE-2026-78129
strongswan
strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.
|
5.9 Medium | — | 0,46% | 11 Sep 2026 |
|
CVE-2026-78130
strongswan
strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.
|
7.5 High | — | 0,35% | 11 Sep 2026 |
|
CVE-2026-78131
strongswan
strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.
|
3.7 Low | — | 0,27% | 11 Sep 2026 |