Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-108493
Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Co...
|
5.3 Medium | — | 0,18% | 13 Okt 2026 |
|
CVE-2026-108492
Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Leve...
|
5.3 Medium | — | 0,18% | 13 Okt 2026 |
|
CVE-2026-108490
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor a...
|
6.5 Medium | — | 0,14% | 13 Okt 2026 |
|
CVE-2026-108489
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retri...
|
5.3 Medium | — | 0,21% | 13 Okt 2026 |
|
CVE-2026-108488
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-...
|
6.5 Medium | — | 0,14% | 13 Okt 2026 |
|
CVE-2026-108487
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak Books Gallery wp-books-gallery allows Stored XSS.This...
|
6.5 Medium | — | 0,13% | 13 Okt 2026 |
|
CVE-2026-108179
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue...
|
7.6 High | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-108174
Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a...
|
5.3 Medium | — | 0,18% | 13 Okt 2026 |
|
CVE-2026-106598
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n...
|
5.3 Medium | — | 0,19% | 13 Okt 2026 |
|
CVE-2026-106597
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a...
|
5.3 Medium | — | 0,19% | 13 Okt 2026 |
|
CVE-2026-105881
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.Thi...
|
6.5 Medium | — | 0,14% | 13 Okt 2026 |
|
CVE-2026-103076
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Registration:...
|
5.4 Medium | — | 0,10% | 13 Okt 2026 |
|
CVE-2026-101020
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local au...
|
8.5 High | — | 0,10% | 13 Okt 2026 |
|
CVE-2026-89097
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp...
|
4.3 Medium | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-67165
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspectin...
|
5.4 Medium | — | 0,15% | 13 Okt 2026 |
|
CVE-2026-15399
The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to in...
|
4.9 Medium | — | 0,36% | 13 Okt 2026 |
|
CVE-2026-14308
Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.
|
4.9 Medium | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-109703
Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.
|
5.3 Medium | — | 0,19% | 13 Okt 2026 |
|
CVE-2026-109109
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component S...
|
10.0 Critical | — | 0,58% | 13 Okt 2026 |
|
CVE-2026-103418
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s pri...
|
8.8 High | — | 0,30% | 13 Okt 2026 |
|
CVE-2026-103417
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the orig...
|
5.5 Medium | — | 0,08% | 13 Okt 2026 |
|
CVE-2026-109108
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the a...
|
9.9 Critical | — | 2,3% | 13 Okt 2026 |
|
CVE-2026-109107
A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argume...
|
6.5 Medium | — | 0,53% | 13 Okt 2026 |
|
CVE-2026-102562
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions...
|
7.2 High | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-102007
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fie...
|
7.2 High | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-75826
Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and...
|
8.5 High | — | 0,94% | 13 Okt 2026 |
|
CVE-2026-109106
A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.service.m.n.a of the component D...
|
4.4 Medium | — | 0,17% | 13 Okt 2026 |
|
CVE-2026-108975
A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admi...
|
7.3 High | — | 0,29% | 13 Okt 2026 |
|
CVE-2026-108974
A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of t...
|
7.3 High | — | 0,29% | 13 Okt 2026 |
|
CVE-2026-108973
A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=sa...
|
7.3 High | — | 0,29% | 13 Okt 2026 |
|
CVE-2026-103316
The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An atta...
|
7.1 High | — | 0,11% | 13 Okt 2026 |
|
CVE-2026-89271
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthent...
|
5.3 Medium | — | 0,23% | 13 Okt 2026 |
|
CVE-2026-89269
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing us...
|
6.8 Medium | — | 0,30% | 13 Okt 2026 |
|
CVE-2026-54870
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows St...
|
6.5 Medium | — | 0,13% | 13 Okt 2026 |
|
CVE-2026-54869
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored...
|
6.5 Medium | — | 0,13% | 13 Okt 2026 |
|
CVE-2026-54868
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS....
|
6.5 Medium | — | 0,13% | 13 Okt 2026 |
|
CVE-2026-54867
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Griden Responsive Slider responsive-slider allows Stored XSS.This is...
|
6.5 Medium | — | 0,13% | 13 Okt 2026 |
|
CVE-2026-108972
A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/empl...
|
7.3 High | — | 0,66% | 13 Okt 2026 |
|
CVE-2026-108971
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server....
|
9.6 Critical | — | 0,22% | 13 Okt 2026 |
|
CVE-2026-108970
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of...
|
7.3 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-108969
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the functio...
|
7.3 High | — | 0,50% | 13 Okt 2026 |
|
CVE-2026-108968
A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php....
|
7.3 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-108967
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The mani...
|
7.3 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-108966
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The ma...
|
7.3 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-109758
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is...
|
9.3 Critical | — | 0,53% | 13 Okt 2026 |
|
CVE-2026-108965
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Exe...
|
7.3 High | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-108964
A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulat...
|
7.3 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-108962
A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file...
|
6.3 Medium | — | 0,40% | 13 Okt 2026 |
|
CVE-2026-108961
A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/tex...
|
6.3 Medium | — | 0,40% | 13 Okt 2026 |
|
CVE-2026-109786
In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs t...
|
5.3 Medium | — | 0,31% | 13 Okt 2026 |