Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 27 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-19500
The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during...
|
7.5 High | — | 0,58% | 18 Agt 2026 |
|
CVE-2026-15806
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL s...
|
6.0 Medium | — | 0,53% | 18 Agt 2026 |
|
CVE-2026-12564
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller p...
|
9.6 Critical | — | 0,35% | 18 Agt 2026 |
|
CVE-2026-75898
RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an o...
|
8.5 High | — | 0,39% | 18 Agt 2026 |
|
CVE-2026-75872
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying ar...
|
6.9 Medium | — | 0,74% | 18 Agt 2026 |
|
CVE-2026-75784
A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP...
|
10.0 Critical | — | 1,1% | 18 Agt 2026 |
|
CVE-2026-75032
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementatio...
|
6.3 Medium | — | 0,24% | 18 Agt 2026 |
|
CVE-2026-74015
Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
|
9.3 Critical | — | 0,40% | 18 Agt 2026 |
|
CVE-2026-74012
Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection.
This issue affects TaxoPress: from n/a through 3.51.0.
|
8.8 High | — | 0,52% | 18 Agt 2026 |
|
CVE-2026-74009
Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
|
5.3 Medium | — | 0,29% | 18 Agt 2026 |
|
CVE-2026-74008
Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensit...
|
5.3 Medium | — | 0,33% | 18 Agt 2026 |
|
CVE-2026-74007
Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.
|
5.3 Medium | — | 0,33% | 18 Agt 2026 |
|
CVE-2026-74006
Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.
|
4.3 Medium | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-74004
Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.
|
5.4 Medium | — | 0,23% | 18 Agt 2026 |
|
CVE-2026-74003
Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
|
4.3 Medium | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-73997
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
|
7.5 High | — | 0,46% | 18 Agt 2026 |
|
CVE-2026-73996
Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.
|
9.8 Critical | — | 0,52% | 18 Agt 2026 |
|
CVE-2026-73995
Subscriber Broken Authentication in User Registration <= 5.2.6 versions.
|
5.4 Medium | — | 0,36% | 18 Agt 2026 |
|
CVE-2026-73994
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
|
7.5 High | — | 0,35% | 18 Agt 2026 |
|
CVE-2026-73426
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attr...
|
4.6 Medium | — | 0,32% | 18 Agt 2026 |
|
CVE-2026-73404
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.
|
6.5 Medium | — | 0,34% | 18 Agt 2026 |
|
CVE-2026-73400
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
|
8.1 High | — | 0,47% | 18 Agt 2026 |
|
CVE-2026-73399
Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.
|
6.5 Medium | — | 0,42% | 18 Agt 2026 |
|
CVE-2026-73398
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.
|
6.5 Medium | — | 0,42% | 18 Agt 2026 |
|
CVE-2026-73397
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
|
9.8 Critical | — | 0,56% | 18 Agt 2026 |
|
CVE-2026-73396
Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.
|
7.1 High | — | 0,40% | 18 Agt 2026 |
|
CVE-2026-73395
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
|
6.5 Medium | — | 0,33% | 18 Agt 2026 |
|
CVE-2026-73393
Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
|
7.1 High | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-73383
Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
|
4.9 Medium | — | 0,47% | 18 Agt 2026 |
|
CVE-2026-73382
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue a...
|
7.1 High | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-73381
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
|
9.1 Critical | — | 0,55% | 18 Agt 2026 |
|
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
|
9.8 Critical | — | 0,56% | 18 Agt 2026 |
|
CVE-2026-73379
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
|
6.5 Medium | — | 0,29% | 18 Agt 2026 |
|
CVE-2026-73378
Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
|
7.1 High | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-73377
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
|
7.5 High | — | 0,35% | 18 Agt 2026 |
|
CVE-2026-73376
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
|
9.8 Critical | — | 0,56% | 18 Agt 2026 |
|
CVE-2026-73375
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
|
7.1 High | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-73367
Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.
|
7.2 High | — | 0,33% | 18 Agt 2026 |
|
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
|
9.8 Critical | — | 0,56% | 18 Agt 2026 |
|
CVE-2026-73365
Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
|
9.3 Critical | — | 0,40% | 18 Agt 2026 |
|
CVE-2026-73362
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
|
7.1 High | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-73361
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
|
7.1 High | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-73360
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.
|
7.1 High | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-73359
Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.
|
6.5 Medium | — | 0,22% | 18 Agt 2026 |
|
CVE-2026-73358
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.
|
7.1 High | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-73356
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
|
8.2 High | — | 0,37% | 18 Agt 2026 |
|
CVE-2026-73355
Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
|
9.3 Critical | — | 0,40% | 18 Agt 2026 |
|
CVE-2026-73352
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
|
6.5 Medium | — | 0,27% | 18 Agt 2026 |
|
CVE-2026-73351
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.
|
7.1 High | — | 0,25% | 18 Agt 2026 |
|
CVE-2026-73350
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
|
8.2 High | — | 0,41% | 18 Agt 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.