Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 27 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-74014
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
|
9.9 Critical | — | 0,48% | 20 Agt 2026 |
|
CVE-2026-74013
Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.
|
8.5 High | — | 0,36% | 20 Agt 2026 |
|
CVE-2026-74001
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
|
9.8 Critical | — | 0,61% | 20 Agt 2026 |
|
CVE-2026-73998
Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.
|
8.5 High | — | 0,36% | 20 Agt 2026 |
|
CVE-2026-73993
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
|
9.8 Critical | — | 0,56% | 20 Agt 2026 |
|
CVE-2026-73992
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
|
9.9 Critical | — | 0,79% | 20 Agt 2026 |
|
CVE-2026-73402
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
|
6.5 Medium | — | 0,22% | 20 Agt 2026 |
|
CVE-2026-68566
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
|
9.3 Critical | — | 0,40% | 20 Agt 2026 |
|
CVE-2026-68564
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66682
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
|
9.8 Critical | — | 0,48% | 20 Agt 2026 |
|
CVE-2026-66680
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
|
9.3 Critical | — | 0,40% | 20 Agt 2026 |
|
CVE-2026-66677
Subscriber Broken Authentication in Leyka <= 3.32.3 versions.
|
7.6 High | — | 0,39% | 20 Agt 2026 |
|
CVE-2026-66673
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66672
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
|
9.8 Critical | — | 0,56% | 20 Agt 2026 |
|
CVE-2026-66649
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
|
9.3 Critical | — | 0,40% | 20 Agt 2026 |
|
CVE-2026-66647
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.
|
6.5 Medium | — | 0,30% | 20 Agt 2026 |
|
CVE-2026-66616
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue af...
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66615
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66614
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66612
Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66611
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66609
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
|
9.3 Critical | — | 0,40% | 20 Agt 2026 |
|
CVE-2026-66607
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66606
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66605
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66604
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66601
Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.
|
6.5 Medium | — | 0,22% | 20 Agt 2026 |
|
CVE-2026-66600
Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.
|
9.1 Critical | — | 0,50% | 20 Agt 2026 |
|
CVE-2026-66598
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66597
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66595
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
|
5.9 Medium | — | 0,32% | 20 Agt 2026 |
|
CVE-2026-66594
Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.
|
8.5 High | — | 0,36% | 20 Agt 2026 |
|
CVE-2026-66593
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.
|
9.3 Critical | — | 0,40% | 20 Agt 2026 |
|
CVE-2026-66592
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress...
|
9.3 Critical | — | 0,40% | 20 Agt 2026 |
|
CVE-2026-66590
Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66586
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
|
6.6 Medium | — | 0,45% | 20 Agt 2026 |
|
CVE-2026-66583
Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.
|
9.8 Critical | — | 0,56% | 20 Agt 2026 |
|
CVE-2026-66582
Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-66581
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
|
7.1 High | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-28150
Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
|
8.1 High | — | 0,47% | 20 Agt 2026 |
|
CVE-2025-62307
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege p...
|
5.4 Medium | — | 0,25% | 20 Agt 2026 |
|
CVE-2025-53999
Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.
|
6.5 Medium | — | 0,33% | 20 Agt 2026 |
|
CVE-2025-15689
Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.
|
9.8 Critical | — | 0,48% | 20 Agt 2026 |
|
CVE-2025-15688
Unauthenticated SQL Injection in Capella <= 2.5.5 versions.
|
9.3 Critical | — | 0,40% | 20 Agt 2026 |
|
CVE-2025-15637
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
|
8.1 High | — | 0,47% | 20 Agt 2026 |
|
CVE-2026-77067
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation h...
|
5.0 Medium | — | 0,27% | 20 Agt 2026 |
|
CVE-2026-77066
The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address va...
|
5.0 Medium | — | 0,25% | 20 Agt 2026 |
|
CVE-2026-77026
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access control. An...
|
6.9 Medium | — | 0,45% | 20 Agt 2026 |
|
CVE-2026-73199
A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweig...
|
6.5 Medium | — | 0,52% | 20 Agt 2026 |
|
CVE-2026-73198
redhat enterprise linux, freeipa
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request b...
|
7.5 High | — | 0,54% | 20 Agt 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.