Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-15823
The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versi...
|
4.3 Medium | — | 0,20% | 10 Sep 2026 |
|
CVE-2026-18594
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not prope...
|
4.3 Medium | — | 0,21% | 10 Sep 2026 |
|
CVE-2026-18386
The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup_file' parameter pa...
|
4.9 Medium | — | 0,73% | 10 Sep 2026 |
|
CVE-2026-15796
The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bg_video_service_url' Setting in all versions up to, and including, 3....
|
6.4 Medium | — | 0,19% | 10 Sep 2026 |
|
CVE-2026-14873
The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the pl...
|
8.0 High | — | 0,23% | 10 Sep 2026 |
|
CVE-2026-15019
The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the (top-level include) funct...
|
7.5 High | — | 0,68% | 10 Sep 2026 |
|
CVE-2026-19584
Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is...
|
7.7 High | — | 0,19% | 10 Sep 2026 |
|
CVE-2026-87870
The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in all versions...
|
6.4 Medium | — | 0,26% | 10 Sep 2026 |
|
CVE-2026-84062
BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may...
|
5.3 Medium | — | 0,30% | 10 Sep 2026 |
|
CVE-2026-84063
BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uplo...
|
8.5 High | — | 0,43% | 10 Sep 2026 |
|
CVE-2026-19583
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on en...
|
9.9 Critical | — | 0,60% | 10 Sep 2026 |
|
CVE-2026-18351
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elemento...
|
9.8 Critical | — | 1,0% | 10 Sep 2026 |
|
CVE-2026-87933
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results...
|
7.3 High | — | 0,53% | 10 Sep 2026 |
|
CVE-2026-87925
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomer...
|
7.3 High | — | 0,43% | 10 Sep 2026 |
|
CVE-2026-87926
A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index...
|
4.3 Medium | — | 0,47% | 10 Sep 2026 |
|
CVE-2026-87931
A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the component App...
|
9.6 Critical | — | 0,60% | 10 Sep 2026 |
|
CVE-2026-87923
A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionalit...
|
4.3 Medium | — | 0,47% | 9 Sep 2026 |
|
CVE-2026-87924
A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the fil...
|
6.5 Medium | — | 0,76% | 9 Sep 2026 |
|
CVE-2026-71809
Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticated attackers to log in as any u...
|
8.1 High | — | 0,59% | 9 Sep 2026 |
|
CVE-2026-15460
The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data PDUs based only on the destina...
|
5.4 Medium | — | 0,16% | 9 Sep 2026 |
|
CVE-2026-88002
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_web...
|
6.5 Medium | — | 0,58% | 9 Sep 2026 |
|
CVE-2026-88069
Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file path...
|
9.3 Critical | — | 0,50% | 9 Sep 2026 |
|
CVE-2026-87997
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completio...
|
4.3 Medium | — | 0,37% | 9 Sep 2026 |
|
CVE-2026-87998
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui...
|
7.1 High | — | 0,49% | 9 Sep 2026 |
|
CVE-2026-87999
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/proce...
|
7.1 High | — | 0,36% | 9 Sep 2026 |
|
CVE-2026-88000
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the c...
|
6.5 Medium | — | 0,59% | 9 Sep 2026 |
|
CVE-2026-88001
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LI...
|
5.0 Medium | — | 0,38% | 9 Sep 2026 |
|
CVE-2026-87921
A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record of the file...
|
7.3 High | — | 0,43% | 9 Sep 2026 |
|
CVE-2026-87922
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function...
|
7.3 High | — | 0,69% | 9 Sep 2026 |
|
CVE-2026-87994
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui...
|
4.3 Medium | — | 0,37% | 9 Sep 2026 |
|
CVE-2026-87995
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendere...
|
8.7 High | — | 0,42% | 9 Sep 2026 |
|
CVE-2026-87996
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web...
|
7.7 High | — | 0,35% | 9 Sep 2026 |
|
CVE-2026-87017
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's read...
|
4.3 Medium | — | 0,37% | 9 Sep 2026 |
|
CVE-2026-87016
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in...
|
8.1 High | — | 0,60% | 9 Sep 2026 |
|
CVE-2026-75307
zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.
|
6.1 Medium | — | 0,25% | 9 Sep 2026 |
|
CVE-2026-75308
yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of...
|
6.1 Medium | — | 0,25% | 9 Sep 2026 |
|
CVE-2026-71805
An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside th...
|
9.8 Critical | — | 0,65% | 9 Sep 2026 |
|
CVE-2026-71807
In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify...
|
4.3 Medium | — | 0,42% | 9 Sep 2026 |
|
CVE-2026-15913
In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Sec...
|
7.7 High | — | 0,39% | 9 Sep 2026 |
|
CVE-2026-87012
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the calendar e...
|
4.3 Medium | — | 0,48% | 9 Sep 2026 |
|
CVE-2026-87013
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to...
|
4.3 Medium | — | 0,48% | 9 Sep 2026 |
|
CVE-2026-87014
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py...
|
6.5 Medium | — | 0,51% | 9 Sep 2026 |
|
CVE-2026-87015
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar fr...
|
6.8 Medium | — | 0,48% | 9 Sep 2026 |
|
CVE-2026-87011
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler...
|
7.5 High | — | 0,64% | 9 Sep 2026 |
|
CVE-2026-79387
SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles)...
|
4.3 Medium | — | 0,29% | 9 Sep 2026 |
|
CVE-2026-79513
gpac
A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Servic...
|
6.5 Medium | — | 0,37% | 9 Sep 2026 |
|
CVE-2026-79514
gpac
An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP r...
|
6.5 Medium | — | 0,54% | 9 Sep 2026 |
|
CVE-2026-79515
An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted TTF fi...
|
4.3 Medium | — | 0,40% | 9 Sep 2026 |
|
CVE-2026-79516
An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a cra...
|
4.0 Medium | — | 0,13% | 9 Sep 2026 |
|
CVE-2026-79522
gpac
An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a cra...
|
6.5 Medium | — | 0,54% | 9 Sep 2026 |