Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-86242
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is...
|
8.1 High | — | 3,6% | 6 Sep 2026 |
|
CVE-2026-86250
h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attac...
|
7.5 High | — | 0,49% | 6 Sep 2026 |
|
CVE-2026-86251
h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot se...
|
5.9 Medium | — | 0,43% | 6 Sep 2026 |
|
CVE-2022-51009
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin pa...
|
7.5 High | — | 0,34% | 6 Sep 2026 |
|
CVE-2022-51008
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attacker...
|
5.3 Medium | — | 0,29% | 6 Sep 2026 |
|
CVE-2021-48006
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but...
|
3.3 Low | — | 0,11% | 6 Sep 2026 |
|
CVE-2021-48007
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement pack...
|
6.5 Medium | — | 0,30% | 6 Sep 2026 |
|
CVE-2020-37277
PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send...
|
6.5 Medium | — | 0,30% | 6 Sep 2026 |
|
CVE-2026-86211
A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipula...
|
7.3 High | — | 0,41% | 6 Sep 2026 |
|
CVE-2026-86209
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_user.php. This manipulation of...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86210
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86208
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /delete_teacher.php. The manipul...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-80437
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into conten...
|
4.8 Medium | — | 0,24% | 6 Sep 2026 |
|
CVE-2026-80439
The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes...
|
4.8 Medium | — | 0,24% | 6 Sep 2026 |
|
CVE-2026-19862
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to...
|
4.8 Medium | — | 0,15% | 6 Sep 2026 |
|
CVE-2026-19859
The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute...
|
6.5 Medium | — | 0,21% | 6 Sep 2026 |
|
CVE-2026-86181
A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the...
|
3.5 Low | — | 0,37% | 6 Sep 2026 |
|
CVE-2026-86182
A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.clas...
|
4.3 Medium | — | 0,23% | 6 Sep 2026 |
|
CVE-2026-86183
A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetAction...
|
5.3 Medium | — | 0,57% | 6 Sep 2026 |
|
CVE-2026-86179
A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/exp_ak.sql of the component Database...
|
5.3 Medium | — | 0,53% | 6 Sep 2026 |
|
CVE-2026-86180
A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of th...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86172
A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the arg...
|
6.3 Medium | — | 0,32% | 6 Sep 2026 |
|
CVE-2026-86171
A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulation of the...
|
6.3 Medium | — | 0,32% | 6 Sep 2026 |
|
CVE-2026-84028
The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the...
|
6.8 Medium | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-84219
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScr...
|
7.5 High | — | 0,37% | 6 Sep 2026 |
|
CVE-2026-85038
The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected...
|
5.3 Medium | — | 0,30% | 6 Sep 2026 |
|
CVE-2026-75793
The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to cr...
|
6.5 Medium | — | 0,27% | 6 Sep 2026 |
|
CVE-2026-18480
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing u...
|
8.8 High | — | 0,24% | 6 Sep 2026 |
|
CVE-2026-13159
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subsc...
|
4.3 Medium | — | 0,10% | 6 Sep 2026 |
|
CVE-2026-86170
A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the arg...
|
6.3 Medium | — | 0,32% | 6 Sep 2026 |
|
CVE-2026-86167
A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulati...
|
9.9 Critical | — | 2,7% | 6 Sep 2026 |
|
CVE-2026-86168
A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the file /login.php. The manipulation o...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86165
A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the ar...
|
9.8 Critical | — | 1,1% | 6 Sep 2026 |
|
CVE-2026-86166
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Serv...
|
8.8 High | — | 0,85% | 6 Sep 2026 |
|
CVE-2026-86164
A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/trans_view.php. The manipulation of...
|
6.3 Medium | — | 0,33% | 6 Sep 2026 |
|
CVE-2026-86163
A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/pro_del.php. The manipulation of the ar...
|
6.3 Medium | — | 0,33% | 6 Sep 2026 |
|
CVE-2026-86161
A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86162
A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /ajax.php?action=login. Executing a manipulation o...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86218
Advisory
n-able n-central
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
|
9.8 Critical | KEV | 13,3% | 6 Sep 2026 |
|
CVE-2026-86159
A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_user. This manipulation of the argumen...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86160
A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voting. Such ma...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-75816
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is du...
|
9.8 Critical | — | 0,91% | 6 Sep 2026 |
|
CVE-2026-18056
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This...
|
7.5 High | — | 0,34% | 6 Sep 2026 |
|
CVE-2026-16310
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing va...
|
9.8 Critical | — | 0,30% | 6 Sep 2026 |
|
CVE-2026-86152
A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin...
|
10.0 Critical | — | 2,9% | 6 Sep 2026 |
|
CVE-2026-86153
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation le...
|
9.1 Critical | — | 0,72% | 6 Sep 2026 |
|
CVE-2026-86151
A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Ma...
|
9.1 Critical | — | 2,9% | 6 Sep 2026 |
|
CVE-2026-86150
A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argumen...
|
4.1 Medium | — | 0,38% | 5 Sep 2026 |
|
CVE-2026-86148
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The mani...
|
9.1 Critical | — | 2,9% | 5 Sep 2026 |
|
CVE-2026-86149
A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument in...
|
9.1 Critical | — | 2,9% | 5 Sep 2026 |