Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 27 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-73340
Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions.
|
6.5 Medium | — | 0,22% | 13 Agt 2026 |
|
CVE-2026-67991
crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore o...
|
7.5 High | — | 0,51% | 13 Agt 2026 |
|
CVE-2026-67990
basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticat...
|
5.4 Medium | — | 0,18% | 13 Agt 2026 |
|
CVE-2026-67986
amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named meth...
|
8.4 High | — | 0,26% | 13 Agt 2026 |
|
CVE-2026-66704
Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.
|
7.2 High | — | 0,27% | 13 Agt 2026 |
|
CVE-2026-66700
Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-66698
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-66697
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-66693
Subscriber Broken Access Control in Motors <= 1.4.113 versions.
|
6.5 Medium | — | 0,30% | 13 Agt 2026 |
|
CVE-2026-66691
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
|
9.8 Critical | — | 0,48% | 13 Agt 2026 |
|
CVE-2026-66689
Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.
|
6.3 Medium | — | 0,26% | 13 Agt 2026 |
|
CVE-2026-66687
Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.
|
6.5 Medium | — | 0,22% | 13 Agt 2026 |
|
CVE-2026-66661
Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.
|
7.7 High | — | 0,33% | 13 Agt 2026 |
|
CVE-2026-66660
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
|
6.5 Medium | — | 0,33% | 13 Agt 2026 |
|
CVE-2026-66658
Subscriber SQL Injection in Reviewer <= 3.14.2 versions.
|
8.5 High | — | 0,36% | 13 Agt 2026 |
|
CVE-2026-66657
Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
|
8.1 High | — | 0,47% | 13 Agt 2026 |
|
CVE-2026-66656
Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
|
8.1 High | — | 0,47% | 13 Agt 2026 |
|
CVE-2026-66655
Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-66654
Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.
|
6.0 Medium | — | 0,21% | 13 Agt 2026 |
|
CVE-2026-66653
Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
|
8.1 High | — | 0,47% | 13 Agt 2026 |
|
CVE-2026-66478
Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.
|
9.3 Critical | — | 0,40% | 13 Agt 2026 |
|
CVE-2026-66472
Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.
|
9.3 Critical | — | 0,40% | 13 Agt 2026 |
|
CVE-2026-66471
Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.
|
6.5 Medium | — | 0,22% | 13 Agt 2026 |
|
CVE-2026-66469
Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.
|
7.5 High | — | 0,35% | 13 Agt 2026 |
|
CVE-2026-66468
Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-66467
Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.
|
6.5 Medium | — | 0,22% | 13 Agt 2026 |
|
CVE-2026-66466
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
|
7.5 High | — | 0,35% | 13 Agt 2026 |
|
CVE-2026-66465
Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.
|
9.8 Critical | — | 0,61% | 13 Agt 2026 |
|
CVE-2026-66464
Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
|
6.5 Medium | — | 0,27% | 13 Agt 2026 |
|
CVE-2026-66463
Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.
|
7.5 High | — | 0,42% | 13 Agt 2026 |
|
CVE-2026-66462
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.
|
7.5 High | — | 0,42% | 13 Agt 2026 |
|
CVE-2026-66461
Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.
|
7.5 High | — | 0,35% | 13 Agt 2026 |
|
CVE-2026-66460
Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.
|
6.5 Medium | — | 0,22% | 13 Agt 2026 |
|
CVE-2026-66459
Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.
|
6.5 Medium | — | 0,33% | 13 Agt 2026 |
|
CVE-2026-66458
Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.
|
9.3 Critical | — | 0,40% | 13 Agt 2026 |
|
CVE-2026-66456
Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.
|
6.5 Medium | — | 0,22% | 13 Agt 2026 |
|
CVE-2026-66455
Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.
|
6.0 Medium | — | 0,21% | 13 Agt 2026 |
|
CVE-2026-66454
Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.
|
6.5 Medium | — | 0,33% | 13 Agt 2026 |
|
CVE-2026-66453
Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.
|
9.8 Critical | — | 0,61% | 13 Agt 2026 |
|
CVE-2026-66450
Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.
|
8.1 High | — | 0,47% | 13 Agt 2026 |
|
CVE-2026-66449
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-66446
Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.
|
9.3 Critical | — | 0,40% | 13 Agt 2026 |
|
CVE-2026-66444
Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.
|
6.5 Medium | — | 0,37% | 13 Agt 2026 |
|
CVE-2026-66443
Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.
|
7.5 High | — | 0,42% | 13 Agt 2026 |
|
CVE-2026-66441
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.
|
7.5 High | — | 0,39% | 13 Agt 2026 |
|
CVE-2026-66436
Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.
|
9.3 Critical | — | 0,40% | 13 Agt 2026 |
|
CVE-2026-66432
Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.
|
7.5 High | — | 0,42% | 13 Agt 2026 |
|
CVE-2026-66431
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.
|
7.5 High | — | 0,35% | 13 Agt 2026 |
|
CVE-2026-66430
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
|
8.5 High | — | 0,36% | 13 Agt 2026 |
|
CVE-2026-66429
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.