Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 27 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-66426
Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-66424
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.
|
9.8 Critical | — | 0,48% | 13 Agt 2026 |
|
CVE-2026-65582
Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.
|
7.7 High | — | 0,44% | 13 Agt 2026 |
|
CVE-2026-65580
Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-61984
Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.
|
7.5 High | — | 0,39% | 13 Agt 2026 |
|
CVE-2026-61980
Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.
|
7.5 High | — | 0,50% | 13 Agt 2026 |
|
CVE-2026-61979
Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.
|
8.1 High | — | 0,42% | 13 Agt 2026 |
|
CVE-2026-61978
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
|
6.5 Medium | — | 0,33% | 13 Agt 2026 |
|
CVE-2026-61974
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-61969
Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.
|
9.3 Critical | — | 0,40% | 13 Agt 2026 |
|
CVE-2026-61967
Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
|
9.8 Critical | — | 0,48% | 13 Agt 2026 |
|
CVE-2026-61966
Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.
|
9.3 Critical | — | 0,40% | 13 Agt 2026 |
|
CVE-2026-61965
Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-61962
Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.
|
10.0 Critical | — | 0,70% | 13 Agt 2026 |
|
CVE-2026-61960
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-48702
Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` d...
|
7.5 High | — | 0,46% | 13 Agt 2026 |
|
CVE-2026-28189
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
|
7.4 High | — | 0,43% | 13 Agt 2026 |
|
CVE-2026-28188
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
|
7.3 High | — | 0,30% | 13 Agt 2026 |
|
CVE-2026-28187
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-28186
Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.
|
8.1 High | — | 0,38% | 13 Agt 2026 |
|
CVE-2026-28185
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.
|
9.8 Critical | — | 0,27% | 13 Agt 2026 |
|
CVE-2026-28182
Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.
|
6.5 Medium | — | 0,22% | 13 Agt 2026 |
|
CVE-2026-28181
Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.
|
6.5 Medium | — | 0,34% | 13 Agt 2026 |
|
CVE-2026-28176
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
|
8.8 High | — | 0,46% | 13 Agt 2026 |
|
CVE-2026-28175
Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-28174
Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.
|
6.5 Medium | — | 0,37% | 13 Agt 2026 |
|
CVE-2026-28173
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
|
7.1 High | — | 0,32% | 13 Agt 2026 |
|
CVE-2026-28170
Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-28168
Subscriber SQL Injection in CubeWP <= 1.1.30 versions.
|
8.5 High | — | 0,36% | 13 Agt 2026 |
|
CVE-2026-28161
Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.
|
8.8 High | — | 0,42% | 13 Agt 2026 |
|
CVE-2026-28159
Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.
|
6.5 Medium | — | 0,37% | 13 Agt 2026 |
|
CVE-2026-28158
Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-28157
Subscriber Path Traversal in Do Lasso <= 358 versions.
|
7.5 High | — | 0,41% | 13 Agt 2026 |
|
CVE-2026-28156
Subscriber SQL Injection in Do Lasso <= 358 versions.
|
8.5 High | — | 0,36% | 13 Agt 2026 |
|
CVE-2026-28155
Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.
|
6.5 Medium | — | 0,33% | 13 Agt 2026 |
|
CVE-2026-28149
Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
|
9.8 Critical | — | 0,56% | 13 Agt 2026 |
|
CVE-2026-28148
Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.
|
9.8 Critical | — | 0,35% | 13 Agt 2026 |
|
CVE-2026-28142
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.
|
9.3 Critical | — | 0,40% | 13 Agt 2026 |
|
CVE-2026-28008
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.
|
9.8 Critical | — | 0,61% | 13 Agt 2026 |
|
CVE-2026-28004
Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-28003
Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-28002
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection.
This issue affects B...
|
8.5 High | — | 0,36% | 13 Agt 2026 |
|
CVE-2026-28001
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
|
9.3 Critical | — | 0,40% | 13 Agt 2026 |
|
CVE-2026-27999
Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.
|
6.5 Medium | — | 0,34% | 13 Agt 2026 |
|
CVE-2026-27544
Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.
|
10.0 Critical | — | 0,86% | 13 Agt 2026 |
|
CVE-2026-27543
Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.
|
8.1 High | — | 0,37% | 13 Agt 2026 |
|
CVE-2026-27539
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
|
CVE-2026-27538
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
|
7.5 High | — | 0,32% | 13 Agt 2026 |
|
CVE-2026-27537
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.
|
6.5 Medium | — | 0,22% | 13 Agt 2026 |
|
CVE-2026-27536
Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.
|
7.1 High | — | 0,25% | 13 Agt 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.