Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-108814
A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possi...
|
6.3 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-108813
A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It...
|
6.3 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-108812
A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such...
|
6.5 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-108811
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes...
|
4.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-108810
A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation...
|
5.3 Medium | — | 0,32% | 12 Okt 2026 |
|
CVE-2026-107432
Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issu...
|
5.4 Medium | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-107430
Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Confi...
|
5.4 Medium | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-107429
Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issu...
|
4.3 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-107427
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Contro...
|
6.5 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-106605
Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement...
|
5.3 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-103356
Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This iss...
|
5.4 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-93582
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environm...
|
9.4 Critical | — | 0,39% | 12 Okt 2026 |
|
CVE-2026-93581
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users...
|
6.1 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-78359
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database...
|
5.4 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-78358
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp...
|
4.3 Medium | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-78357
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result...
|
9.1 Critical | — | 0,30% | 12 Okt 2026 |
|
CVE-2026-78356
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configura...
|
5.3 Medium | — | 0,28% | 12 Okt 2026 |
|
CVE-2026-78355
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory....
|
8.7 High | — | 0,72% | 12 Okt 2026 |
|
CVE-2026-48212
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser...
|
4.8 Medium | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-48211
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExp...
|
5.4 Medium | — | 0,12% | 12 Okt 2026 |
|
CVE-2026-109082
A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advance...
|
6.8 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-108809
A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid...
|
3.5 Low | — | 0,18% | 12 Okt 2026 |
|
CVE-2026-108808
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-co...
|
2.6 Low | — | 0,18% | 12 Okt 2026 |
|
CVE-2026-108807
A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysql_query of the file source...
|
7.3 High | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-84167
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscrib...
|
4.3 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-84166
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in...
|
4.3 Medium | — | 0,10% | 12 Okt 2026 |
|
CVE-2026-109080
SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including...
|
6.5 Medium | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-108806
A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query...
|
7.3 High | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-108805
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query o...
|
7.3 High | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-108804
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component W...
|
10.0 Critical | — | 2,4% | 12 Okt 2026 |
|
CVE-2026-108803
A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable...
|
6.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-107791
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authent...
|
6.5 Medium | — | 0,18% | 12 Okt 2026 |
|
CVE-2025-15703
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings pag...
|
3.5 Low | — | 0,15% | 12 Okt 2026 |
|
CVE-2026-108802
A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data D...
|
3.5 Low | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-107203
An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks only that the...
|
5.4 Medium | — | 0,15% | 12 Okt 2026 |
|
CVE-2026-107193
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's p...
|
6.5 Medium | — | 0,18% | 12 Okt 2026 |
|
CVE-2026-87690
The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file...
|
8.8 High | — | 0,41% | 12 Okt 2026 |
|
CVE-2026-21139
Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.
|
7.3 High | — | 0,12% | 12 Okt 2026 |
|
CVE-2026-21138
Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.
|
6.9 Medium | — | 0,10% | 12 Okt 2026 |
|
CVE-2026-21137
Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.
|
5.1 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-21136
Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
|
6.8 Medium | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-21135
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.
|
5.9 Medium | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-21134
Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.
|
6.1 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-21133
Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.
|
5.1 Medium | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-21132
Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering t...
|
6.0 Medium | — | 0,52% | 12 Okt 2026 |
|
CVE-2026-21131
Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connecte...
|
2.1 Low | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-21130
Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung...
|
5.1 Medium | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-21129
Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Sam...
|
5.1 Medium | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-21128
Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Che...
|
5.1 Medium | — | 0,12% | 12 Okt 2026 |
|
CVE-2026-21127
Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.
|
6.9 Medium | — | 0,11% | 12 Okt 2026 |