Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 27 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-70646
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifyi...
|
7.5 High | — | 0,64% | 6 Agt 2026 |
|
CVE-2026-70637
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR...
|
5.9 Medium | — | 0,37% | 6 Agt 2026 |
|
CVE-2026-67261
dell virtual storage integrator
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote u...
|
9.8 Critical | — | 2,3% | 6 Agt 2026 |
|
CVE-2026-66712
Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
|
7.5 High | — | 0,35% | 6 Agt 2026 |
|
CVE-2026-66711
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66710
Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
|
8.1 High | — | 0,47% | 6 Agt 2026 |
|
CVE-2026-66709
Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
|
9.1 Critical | — | 0,82% | 6 Agt 2026 |
|
CVE-2026-66708
Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.
|
8.2 High | — | 0,37% | 6 Agt 2026 |
|
CVE-2026-66707
Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66706
Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
|
5.9 Medium | — | 0,24% | 6 Agt 2026 |
|
CVE-2026-66705
Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66703
Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.
|
6.5 Medium | — | 0,22% | 6 Agt 2026 |
|
CVE-2026-66702
Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66701
Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.
|
5.3 Medium | — | 0,29% | 6 Agt 2026 |
|
CVE-2026-66699
Custom role Broken Access Control in Dokan <= 5.0.10 versions.
|
5.3 Medium | — | 0,29% | 6 Agt 2026 |
|
CVE-2026-66696
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
|
4.3 Medium | — | 0,30% | 6 Agt 2026 |
|
CVE-2026-66695
Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.
|
6.5 Medium | — | 0,41% | 6 Agt 2026 |
|
CVE-2026-66694
Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66692
Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
|
4.3 Medium | — | 0,27% | 6 Agt 2026 |
|
CVE-2026-66690
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66688
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.
|
6.5 Medium | — | 0,22% | 6 Agt 2026 |
|
CVE-2026-66686
Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.
|
6.5 Medium | — | 0,17% | 6 Agt 2026 |
|
CVE-2026-66685
Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.
|
5.3 Medium | — | 0,33% | 6 Agt 2026 |
|
CVE-2026-66684
Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.
|
5.3 Medium | — | 0,33% | 6 Agt 2026 |
|
CVE-2026-66683
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.
|
5.3 Medium | — | 0,33% | 6 Agt 2026 |
|
CVE-2026-66681
Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.
|
4.3 Medium | — | 0,14% | 6 Agt 2026 |
|
CVE-2026-66678
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.
|
4.3 Medium | — | 0,27% | 6 Agt 2026 |
|
CVE-2026-66665
Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
|
10.0 Critical | — | 0,52% | 6 Agt 2026 |
|
CVE-2026-66664
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66663
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66662
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
|
9.8 Critical | — | 0,55% | 6 Agt 2026 |
|
CVE-2026-66470
Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.
|
7.1 High | — | 0,32% | 6 Agt 2026 |
|
CVE-2026-66457
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This iss...
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66452
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.
|
6.5 Medium | — | 0,33% | 6 Agt 2026 |
|
CVE-2026-66451
Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.
|
6.5 Medium | — | 0,33% | 6 Agt 2026 |
|
CVE-2026-66447
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
|
9.3 Critical | — | 0,40% | 6 Agt 2026 |
|
CVE-2026-66440
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66439
Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-66425
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.
|
6.5 Medium | — | 0,42% | 6 Agt 2026 |
|
CVE-2026-65581
Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65579
Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65578
Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65577
Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65576
Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65575
Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65574
Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65573
Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65572
Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65571
Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65570
Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.
|
8.1 High | — | 0,40% | 6 Agt 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.