Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 22 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-85304
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Acce...
|
5.3 Medium | — | 0,31% | 3 Sep 2026 |
|
CVE-2026-85303
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS.
This...
|
6.5 Medium | — | 0,22% | 3 Sep 2026 |
|
CVE-2026-85302
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Base...
|
6.5 Medium | — | 0,22% | 3 Sep 2026 |
|
CVE-2026-85242
PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the application...
|
6.9 Medium | — | 0,43% | 3 Sep 2026 |
|
CVE-2026-85186
A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/con...
|
6.3 Medium | — | 0,37% | 3 Sep 2026 |
|
CVE-2026-84849
Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.
|
6.5 Medium | — | 0,29% | 3 Sep 2026 |
|
CVE-2026-84848
Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.
|
7.1 High | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-84847
Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.
|
7.5 High | — | 0,35% | 3 Sep 2026 |
|
CVE-2026-84836
Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.
|
7.1 High | — | 0,29% | 3 Sep 2026 |
|
CVE-2026-84834
Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.
|
9.8 Critical | — | 0,56% | 3 Sep 2026 |
|
CVE-2026-84814
Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.
|
9.8 Critical | — | 0,48% | 3 Sep 2026 |
|
CVE-2026-84813
Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
|
9.3 Critical | — | 0,40% | 3 Sep 2026 |
|
CVE-2026-84812
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
|
7.1 High | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-84779
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.
|
8.1 High | — | 0,35% | 3 Sep 2026 |
|
CVE-2026-84778
Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions.
|
7.5 High | — | 0,46% | 3 Sep 2026 |
|
CVE-2026-84777
Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.
|
7.4 High | — | 0,39% | 3 Sep 2026 |
|
CVE-2026-84776
Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.
|
7.5 High | — | 0,46% | 3 Sep 2026 |
|
CVE-2026-84774
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.
|
6.1 Medium | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-84773
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.
|
7.2 High | — | 0,28% | 3 Sep 2026 |
|
CVE-2026-84769
Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.
|
6.5 Medium | — | 0,27% | 3 Sep 2026 |
|
CVE-2026-84768
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
|
9.3 Critical | — | 0,40% | 3 Sep 2026 |
|
CVE-2026-84767
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
|
5.3 Medium | — | 0,18% | 3 Sep 2026 |
|
CVE-2026-84766
Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.
|
5.9 Medium | — | 0,32% | 3 Sep 2026 |
|
CVE-2026-84765
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
|
7.1 High | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-84763
Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.
|
7.1 High | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-84762
Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.
|
5.3 Medium | — | 0,35% | 3 Sep 2026 |
|
CVE-2026-84761
Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.
|
7.2 High | — | 0,27% | 3 Sep 2026 |
|
CVE-2026-84758
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
|
6.5 Medium | — | 0,33% | 3 Sep 2026 |
|
CVE-2026-84757
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
|
8.2 High | — | 0,39% | 3 Sep 2026 |
|
CVE-2026-84756
Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.
|
7.1 High | — | 0,28% | 3 Sep 2026 |
|
CVE-2026-84755
Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.
|
6.5 Medium | — | 0,27% | 3 Sep 2026 |
|
CVE-2026-84754
Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.
|
6.5 Medium | — | 0,33% | 3 Sep 2026 |
|
CVE-2026-84753
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
|
9.8 Critical | — | 0,56% | 3 Sep 2026 |
|
CVE-2026-84752
Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.
|
8.8 High | — | 0,52% | 3 Sep 2026 |
|
CVE-2026-84736
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation fo...
|
8.3 High | — | 0,27% | 3 Sep 2026 |
|
CVE-2026-84238
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
|
9.8 Critical | — | 0,48% | 3 Sep 2026 |
|
CVE-2026-84215
Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
|
6.5 Medium | — | 0,33% | 3 Sep 2026 |
|
CVE-2026-81776
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
|
7.1 High | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-81773
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
|
7.1 High | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-81300
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
|
7.1 High | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-81295
Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.
|
7.1 High | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-81292
Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
|
7.1 High | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-81282
Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.
|
6.5 Medium | — | 0,22% | 3 Sep 2026 |
|
CVE-2026-81281
Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.
|
6.5 Medium | — | 0,22% | 3 Sep 2026 |
|
CVE-2026-75602
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHt...
|
6.5 Medium | — | 0,69% | 3 Sep 2026 |
|
CVE-2026-85239
misp-project misp
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template d...
|
6.5 Medium | — | 0,45% | 3 Sep 2026 |
|
CVE-2026-85238
misp-project misp
MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAu...
|
6.8 Medium | — | 0,34% | 3 Sep 2026 |
|
CVE-2026-85237
misp-project misp
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts.
Th...
|
8.1 High | — | 0,46% | 3 Sep 2026 |
|
CVE-2026-85236
misp-project misp
A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while...
|
8.8 High | — | 0,25% | 3 Sep 2026 |
|
CVE-2026-85138
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of th...
|
7.3 High | — | 0,41% | 3 Sep 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.