Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 25 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-66155
A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V...
|
7.6 High | — | 0,28% | 27 Agt 2026 |
|
CVE-2026-5218
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allow...
|
4.3 Medium | — | 0,28% | 27 Agt 2026 |
|
CVE-2026-17562
Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs.
Thi...
|
6.5 Medium | — | 0,36% | 27 Agt 2026 |
|
CVE-2026-81625
A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gai...
|
8.8 High | — | 0,57% | 27 Agt 2026 |
|
CVE-2026-81581
Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of t...
|
8.8 High | — | 0,22% | 27 Agt 2026 |
|
CVE-2026-81579
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write...
|
8.8 High | — | 0,17% | 27 Agt 2026 |
|
CVE-2026-81576
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak
SID as sole authenticator...
|
7.7 High | — | 0,34% | 27 Agt 2026 |
|
CVE-2026-81575
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and
the data itself. Missing...
|
7.5 High | — | 0,46% | 27 Agt 2026 |
|
CVE-2026-81574
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format
speci...
|
8.2 High | — | 0,43% | 27 Agt 2026 |
|
CVE-2026-81573
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-
origin restrictions. Commands intended on...
|
8.6 High | — | 0,40% | 27 Agt 2026 |
|
CVE-2026-81572
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-S...
|
7.8 High | — | 0,18% | 27 Agt 2026 |
|
CVE-2026-81279
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
|
5.4 Medium | — | 0,23% | 27 Agt 2026 |
|
CVE-2026-81277
Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
|
8.5 High | — | 0,36% | 27 Agt 2026 |
|
CVE-2026-81276
Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.
|
5.3 Medium | — | 0,29% | 27 Agt 2026 |
|
CVE-2026-81274
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
|
5.3 Medium | — | 0,29% | 27 Agt 2026 |
|
CVE-2026-81273
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
|
8.1 High | — | 0,19% | 27 Agt 2026 |
|
CVE-2026-81272
Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
|
4.9 Medium | — | 0,33% | 27 Agt 2026 |
|
CVE-2026-81271
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
|
8.8 High | — | 0,20% | 27 Agt 2026 |
|
CVE-2026-80433
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
|
7.5 High | — | 0,39% | 27 Agt 2026 |
|
CVE-2026-78293
Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
|
7.1 High | — | 0,25% | 27 Agt 2026 |
|
CVE-2026-78292
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
|
9.8 Critical | — | 0,56% | 27 Agt 2026 |
|
CVE-2026-78289
Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
|
7.1 High | — | 0,25% | 27 Agt 2026 |
|
CVE-2026-78288
Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
|
9.3 Critical | — | 0,40% | 27 Agt 2026 |
|
CVE-2026-78286
Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
|
9.8 Critical | — | 0,56% | 27 Agt 2026 |
|
CVE-2026-78285
Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.
|
8.5 High | — | 0,36% | 27 Agt 2026 |
|
CVE-2026-78283
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
|
7.1 High | — | 0,25% | 27 Agt 2026 |
|
CVE-2026-78281
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
|
7.1 High | — | 0,25% | 27 Agt 2026 |
|
CVE-2026-78276
Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
|
7.2 High | — | 0,54% | 27 Agt 2026 |
|
CVE-2026-78275
Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.
|
6.8 Medium | — | 0,50% | 27 Agt 2026 |
|
CVE-2026-78274
Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.
|
9.1 Critical | — | 0,50% | 27 Agt 2026 |
|
CVE-2026-78273
Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.
|
6.5 Medium | — | 0,22% | 27 Agt 2026 |
|
CVE-2026-78271
Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.
|
7.2 High | — | 0,46% | 27 Agt 2026 |
|
CVE-2026-78261
Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.
|
7.1 High | — | 0,25% | 27 Agt 2026 |
|
CVE-2026-78260
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
|
9.3 Critical | — | 0,40% | 27 Agt 2026 |
|
CVE-2026-78257
Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.
|
8.8 High | — | 0,52% | 27 Agt 2026 |
|
CVE-2026-75020
apache apisix
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX.
A caller who holds valid credentials for one entry i...
|
8.1 High | — | 0,55% | 27 Agt 2026 |
|
CVE-2026-75005
apache apisix
Inefficient Algorithmic Complexity vulnerability in Apache APISIX.
A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-c...
|
7.5 High | — | 0,74% | 27 Agt 2026 |
|
CVE-2026-74848
apache apisix
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX.
An attacker could make other clients receive attacker-ch...
|
7.5 High | — | 0,59% | 27 Agt 2026 |
|
CVE-2026-59355
broadcom spring authorization server
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can...
|
6.1 Medium | — | 0,24% | 27 Agt 2026 |
|
CVE-2026-59354
Advisory
vmware spring security
In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint...
|
8.8 High | — | 0,49% | 27 Agt 2026 |
|
CVE-2026-32566
Advisory
Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
|
9.8 Critical | — | 0,48% | 27 Agt 2026 |
|
CVE-2026-32564
Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
|
8.5 High | — | 0,36% | 27 Agt 2026 |
|
CVE-2026-32550
Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.
|
8.5 High | — | 0,36% | 27 Agt 2026 |
|
CVE-2026-32479
Advisory
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.
|
9.3 Critical | — | 0,40% | 27 Agt 2026 |
|
CVE-2026-27330
Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.
|
8.6 High | — | 0,36% | 27 Agt 2026 |
|
CVE-2026-78333
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and...
|
8.8 High | — | 0,51% | 27 Agt 2026 |
|
CVE-2026-78139
The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and i...
|
4.3 Medium | — | 0,25% | 27 Agt 2026 |
|
CVE-2026-78138
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post...
|
4.3 Medium | — | 0,30% | 27 Agt 2026 |
|
CVE-2026-78137
The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attacker...
|
7.5 High | — | 0,39% | 27 Agt 2026 |
|
CVE-2026-78125
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing...
|
5.3 Medium | — | 0,35% | 27 Agt 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.