Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 27 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-65569
Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.
|
8.5 High | — | 0,36% | 6 Agt 2026 |
|
CVE-2026-65565
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-65560
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-65559
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.
|
7.2 High | — | 0,46% | 6 Agt 2026 |
|
CVE-2026-65556
Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65554
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.
|
7.1 High | — | 0,34% | 6 Agt 2026 |
|
CVE-2026-65553
Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
|
10.0 Critical | — | 0,86% | 6 Agt 2026 |
|
CVE-2026-65552
Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
|
9.8 Critical | — | 0,56% | 6 Agt 2026 |
|
CVE-2026-65549
Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.
|
7.2 High | — | 0,54% | 6 Agt 2026 |
|
CVE-2026-65548
Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.
|
9.9 Critical | — | 0,79% | 6 Agt 2026 |
|
CVE-2026-65546
Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
|
9.3 Critical | — | 0,40% | 6 Agt 2026 |
|
CVE-2026-65545
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-65544
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-65543
Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.
|
7.5 High | — | 0,42% | 6 Agt 2026 |
|
CVE-2026-65542
Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.
|
8.8 High | — | 0,50% | 6 Agt 2026 |
|
CVE-2026-65541
Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.
|
7.3 High | — | 0,30% | 6 Agt 2026 |
|
CVE-2026-65523
Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.
|
7.5 High | — | 0,39% | 6 Agt 2026 |
|
CVE-2026-65520
Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
|
9.3 Critical | — | 0,40% | 6 Agt 2026 |
|
CVE-2026-65517
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-65515
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-65513
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-65509
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-65508
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
|
9.3 Critical | — | 0,40% | 6 Agt 2026 |
|
CVE-2026-65507
Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.
|
9.8 Critical | — | 0,48% | 6 Agt 2026 |
|
CVE-2026-65504
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.
|
7.5 High | — | 0,39% | 6 Agt 2026 |
|
CVE-2026-65502
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.
|
5.3 Medium | — | 0,33% | 6 Agt 2026 |
|
CVE-2026-61982
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-61964
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-61963
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-61961
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-61959
Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.
|
6.5 Medium | — | 0,22% | 6 Agt 2026 |
|
CVE-2026-54489
dell virtual storage integrator
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated re...
|
9.8 Critical | — | 0,62% | 6 Agt 2026 |
|
CVE-2026-53976
OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote at...
|
9.1 Critical | — | 2,6% | 6 Agt 2026 |
|
CVE-2026-53975
OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POS...
|
9.8 Critical | — | 1,7% | 6 Agt 2026 |
|
CVE-2026-34502
apache apr-util
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client
This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...
|
7.5 High | — | 0,51% | 6 Agt 2026 |
|
CVE-2026-34501
apache apr-util
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.
This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3....
|
7.5 High | — | 0,51% | 6 Agt 2026 |
|
CVE-2026-34191
apache apr-util
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.
This i...
|
9.1 Critical | — | 0,59% | 6 Agt 2026 |
|
CVE-2026-32548
Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.
|
5.3 Medium | — | 0,31% | 6 Agt 2026 |
|
CVE-2026-32469
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.
|
5.3 Medium | — | 0,33% | 6 Agt 2026 |
|
CVE-2026-32327
apache apr-util
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_qu...
|
9.1 Critical | — | 0,46% | 6 Agt 2026 |
|
CVE-2026-28183
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishP...
|
7.2 High | — | 0,46% | 6 Agt 2026 |
|
CVE-2026-28180
Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.
|
5.3 Medium | — | 0,31% | 6 Agt 2026 |
|
CVE-2026-28179
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
|
5.9 Medium | — | 0,24% | 6 Agt 2026 |
|
CVE-2026-28178
Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
|
6.5 Medium | — | 0,22% | 6 Agt 2026 |
|
CVE-2026-28177
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This...
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-28172
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.
|
7.1 High | — | 0,13% | 6 Agt 2026 |
|
CVE-2026-28169
Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
|
5.3 Medium | — | 0,33% | 6 Agt 2026 |
|
CVE-2026-28146
Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.
|
6.5 Medium | — | 0,44% | 6 Agt 2026 |
|
CVE-2026-28143
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.
|
7.1 High | — | 0,25% | 6 Agt 2026 |
|
CVE-2026-28141
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
|
7.1 High | — | 0,47% | 6 Agt 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.