Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-86112
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite foll...
|
5.4 Medium | — | 0,30% | 5 Sep 2026 |
|
CVE-2026-86113
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading reco...
|
6.5 Medium | — | 0,42% | 5 Sep 2026 |
|
CVE-2026-86114
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including...
|
6.5 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-86115
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentica...
|
5.0 Medium | — | 0,50% | 5 Sep 2026 |
|
CVE-2026-86116
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete gl...
|
6.5 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-86117
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address...
|
8.1 High | — | 0,67% | 5 Sep 2026 |
|
CVE-2026-86111
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-messa...
|
6.5 Medium | — | 0,44% | 5 Sep 2026 |
|
CVE-2026-76573
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all versions up to, an...
|
6.4 Medium | — | 0,35% | 5 Sep 2026 |
|
CVE-2024-11080
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in...
|
9.8 Critical | — | 0,45% | 5 Sep 2026 |
|
CVE-2026-75586
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and includin...
|
6.1 Medium | — | 0,38% | 5 Sep 2026 |
|
CVE-2026-75018
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly ver...
|
4.3 Medium | — | 0,49% | 5 Sep 2026 |
|
CVE-2026-85414
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including,...
|
6.4 Medium | — | 0,42% | 5 Sep 2026 |
|
CVE-2026-81543
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing cap...
|
8.8 High | — | 0,44% | 5 Sep 2026 |
|
CVE-2026-83625
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to...
|
7.2 High | — | 0,58% | 5 Sep 2026 |
|
CVE-2026-84898
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-leve...
|
6.6 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-84899
The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the C...
|
6.8 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-84901
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level ac...
|
4.9 Medium | — | 0,33% | 5 Sep 2026 |
|
CVE-2026-84926
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated us...
|
2.7 Low | — | 0,32% | 5 Sep 2026 |
|
CVE-2026-84927
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Cont...
|
2.7 Low | — | 0,28% | 5 Sep 2026 |
|
CVE-2026-84930
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its galler...
|
6.8 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-84931
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute,...
|
6.8 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-84934
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal act...
|
8.0 High | — | 0,41% | 5 Sep 2026 |
|
CVE-2026-84935
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those...
|
8.0 High | — | 0,41% | 5 Sep 2026 |
|
CVE-2026-84936
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to ma...
|
5.3 Medium | — | 0,30% | 5 Sep 2026 |
|
CVE-2026-84937
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users w...
|
6.8 Medium | — | 0,39% | 5 Sep 2026 |
|
CVE-2026-84745
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users wit...
|
2.7 Low | — | 0,32% | 5 Sep 2026 |
|
CVE-2026-84896
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users wi...
|
6.8 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-84021
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evade...
|
6.8 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-84022
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users wi...
|
6.8 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-84221
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to a...
|
6.8 Medium | — | 0,40% | 5 Sep 2026 |
|
CVE-2026-84225
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an adminis...
|
2.2 Low | — | 0,23% | 5 Sep 2026 |
|
CVE-2026-83543
The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and abov...
|
4.1 Medium | — | 0,30% | 5 Sep 2026 |
|
CVE-2026-83544
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with con...
|
6.8 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-82846
The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing us...
|
6.8 Medium | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-82304
The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unaut...
|
8.6 High | — | 0,45% | 5 Sep 2026 |
|
CVE-2026-81348
The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthentic...
|
3.7 Low | — | 0,28% | 5 Sep 2026 |
|
CVE-2026-81404
The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attac...
|
7.1 High | — | 0,28% | 5 Sep 2026 |
|
CVE-2026-81423
The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redire...
|
4.3 Medium | — | 0,30% | 5 Sep 2026 |
|
CVE-2026-81424
The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative pay...
|
5.3 Medium | — | 0,30% | 5 Sep 2026 |
|
CVE-2026-77826
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, a...
|
8.8 High | — | 0,41% | 5 Sep 2026 |
|
CVE-2026-77830
The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all...
|
7.2 High | — | 0,47% | 5 Sep 2026 |
|
CVE-2026-78149
The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthen...
|
5.3 Medium | — | 0,35% | 5 Sep 2026 |
|
CVE-2026-78150
The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privilege...
|
2.7 Low | — | 0,30% | 5 Sep 2026 |
|
CVE-2026-78362
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be s...
|
9.8 Critical | — | 0,50% | 5 Sep 2026 |
|
CVE-2026-78438
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and includ...
|
7.2 High | — | 0,50% | 5 Sep 2026 |
|
CVE-2026-18406
The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encode...
|
7.2 High | — | 0,29% | 5 Sep 2026 |
|
CVE-2026-18843
The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter in all ve...
|
6.1 Medium | — | 0,17% | 5 Sep 2026 |
|
CVE-2026-19769
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via U...
|
7.2 High | — | 0,25% | 5 Sep 2026 |
|
CVE-2026-19858
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page ren...
|
7.5 High | — | 0,32% | 5 Sep 2026 |
|
CVE-2026-19861
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTM...
|
4.7 Medium | — | 0,17% | 5 Sep 2026 |