Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-19887
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in t...
|
8.8 High | — | 0,57% | 5 Sep 2026 |
|
CVE-2026-4361
The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oembed_thumbna...
|
5.0 Medium | — | 0,36% | 5 Sep 2026 |
|
CVE-2026-3853
The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versio...
|
6.4 Medium | — | 0,26% | 5 Sep 2026 |
|
CVE-2025-15693
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the sit...
|
2.7 Low | — | 0,26% | 5 Sep 2026 |
|
CVE-2025-15694
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high...
|
3.5 Low | — | 0,17% | 5 Sep 2026 |
|
CVE-2026-16649
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insuffic...
|
7.2 High | — | 0,19% | 5 Sep 2026 |
|
CVE-2026-15247
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handler...
|
5.4 Medium | — | 0,20% | 5 Sep 2026 |
|
CVE-2026-15984
The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficien...
|
7.2 High | — | 0,19% | 5 Sep 2026 |
|
CVE-2026-14975
The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it po...
|
6.5 Medium | — | 0,68% | 5 Sep 2026 |
|
CVE-2026-83627
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3....
|
9.8 Critical | — | 1,4% | 5 Sep 2026 |
|
CVE-2026-83628
The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tm...
|
4.3 Medium | — | 0,39% | 5 Sep 2026 |
|
CVE-2026-86145
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even...
|
8.2 High | — | 0,39% | 5 Sep 2026 |
|
CVE-2026-8623
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (class attrib...
|
6.4 Medium | — | 0,35% | 5 Sep 2026 |
|
CVE-2026-8625
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML...
|
6.4 Medium | — | 0,36% | 5 Sep 2026 |
|
CVE-2026-77233
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSens...
|
7.2 High | — | 0,51% | 5 Sep 2026 |
|
CVE-2026-77263
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all ver...
|
7.2 High | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-13447
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic s...
|
9.8 Critical | — | 0,45% | 5 Sep 2026 |
|
CVE-2026-18404
The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box in a...
|
6.4 Medium | — | 0,20% | 5 Sep 2026 |
|
CVE-2025-14945
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions u...
|
5.4 Medium | — | 0,22% | 5 Sep 2026 |
|
CVE-2026-86141
xmlsoft libxml2
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL ch...
|
3.3 Low | — | 0,17% | 5 Sep 2026 |
|
CVE-2026-86142
xmlsoft libxml2
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
|
7.8 High | — | 0,16% | 5 Sep 2026 |
|
CVE-2026-86143
xmlsoft libxml2
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for in...
|
7.3 High | — | 0,19% | 5 Sep 2026 |
|
CVE-2026-86144
xmlsoft libxml2
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PAR...
|
7.8 High | — | 0,19% | 5 Sep 2026 |
|
CVE-2026-86138
xmlsoft libxml2
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
|
7.8 High | — | 0,13% | 5 Sep 2026 |
|
CVE-2026-86139
xmlsoft libxml2
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
|
7.8 High | — | 0,17% | 5 Sep 2026 |
|
CVE-2026-86140
xmlsoft libxml2
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
|
7.8 High | — | 0,16% | 5 Sep 2026 |
|
CVE-2026-86137
xmlsoft libxml2
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
|
6.1 Medium | — | 0,19% | 5 Sep 2026 |
|
CVE-2026-86100
Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can s...
|
6.4 Medium | — | 0,32% | 5 Sep 2026 |
|
CVE-2026-52772
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-bo...
|
5.5 Medium | — | 0,34% | 5 Sep 2026 |
|
CVE-2026-52773
YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML i...
|
6.1 Medium | — | 0,59% | 5 Sep 2026 |
|
CVE-2026-52774
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only...
|
6.1 Medium | — | 0,66% | 5 Sep 2026 |
|
CVE-2026-52775
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::...
|
8.8 High | — | 0,48% | 5 Sep 2026 |
|
CVE-2026-52777
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This i...
|
9.4 Critical | — | 0,28% | 5 Sep 2026 |
|
CVE-2026-52763
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint paramete...
|
6.5 Medium | — | 0,38% | 5 Sep 2026 |
|
CVE-2026-52766
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array f...
|
9.1 Critical | — | 0,58% | 5 Sep 2026 |
|
CVE-2026-52767
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() w...
|
8.2 High | — | 0,35% | 5 Sep 2026 |
|
CVE-2026-52769
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - exposed publicly with acl:"public" -...
|
8.3 High | — | 0,49% | 5 Sep 2026 |
|
CVE-2026-52770
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric quer...
|
7.5 High | — | 0,47% | 5 Sep 2026 |
|
CVE-2026-52771
YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into...
|
8.3 High | — | 0,51% | 5 Sep 2026 |
|
CVE-2026-52762
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic templ...
|
7.1 High | — | 0,78% | 5 Sep 2026 |
|
CVE-2026-86095
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer with...
|
7.8 High | — | 0,18% | 4 Sep 2026 |
|
CVE-2026-86096
PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion....
|
5.9 Medium | — | 0,33% | 4 Sep 2026 |
|
CVE-2026-86097
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to...
|
6.5 Medium | — | 0,40% | 4 Sep 2026 |
|
CVE-2026-86098
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. A...
|
7.4 High | — | 0,59% | 4 Sep 2026 |
|
CVE-2026-48019
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfo...
|
8.9 High | — | 0,51% | 4 Sep 2026 |
|
CVE-2026-86090
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue PO...
|
7.1 High | — | 0,45% | 4 Sep 2026 |
|
CVE-2026-86091
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member b...
|
7.1 High | — | 0,52% | 4 Sep 2026 |
|
CVE-2026-76925
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occ...
|
5.8 Medium | — | 0,10% | 4 Sep 2026 |
|
CVE-2026-77393
In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute...
|
8.8 High | — | 0,51% | 4 Sep 2026 |
|
CVE-2026-75925
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted...
|
9.6 Critical | — | 0,67% | 4 Sep 2026 |