Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-108712
SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view othe...
|
4.3 Medium | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-108711
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because get...
|
4.3 Medium | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-108710
NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and...
|
6.5 Medium | — | 0,35% | 11 Okt 2026 |
|
CVE-2026-108584
A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipul...
|
5.3 Medium | — | 0,36% | 11 Okt 2026 |
|
CVE-2026-108578
A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation...
|
5.3 Medium | — | 0,49% | 11 Okt 2026 |
|
CVE-2026-108577
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the compon...
|
4.3 Medium | — | 0,29% | 11 Okt 2026 |
|
CVE-2026-108576
A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of...
|
10.0 Critical | — | 2,5% | 11 Okt 2026 |
|
CVE-2026-108575
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolutio...
|
6.3 Medium | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-108574
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm/proxy/spend_tracking/spend_ma...
|
4.3 Medium | — | 0,24% | 11 Okt 2026 |
|
CVE-2026-108573
A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component...
|
5.5 Medium | — | 0,17% | 11 Okt 2026 |
|
CVE-2026-108572
A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Pr...
|
4.3 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-108571
A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php...
|
7.3 High | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-108570
A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngi...
|
6.3 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-108569
A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensi...
|
6.3 Medium | — | 0,30% | 11 Okt 2026 |
|
CVE-2026-108568
A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/...
|
4.3 Medium | — | 0,13% | 11 Okt 2026 |
|
CVE-2026-108567
A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler...
|
4.3 Medium | — | 0,53% | 11 Okt 2026 |
|
CVE-2026-108566
A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php o...
|
3.5 Low | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-108544
A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxviewer.document.docx.reader.ViewTx...
|
6.3 Medium | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-108543
A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the ar...
|
6.3 Medium | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-108542
A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Re...
|
6.3 Medium | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-97183
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber,...
|
4.3 Medium | — | 0,18% | 11 Okt 2026 |
|
CVE-2026-96227
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be...
|
8.8 High | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-94235
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscri...
|
4.3 Medium | — | 0,15% | 11 Okt 2026 |
|
CVE-2026-93550
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before d...
|
4.3 Medium | — | 0,18% | 11 Okt 2026 |
|
CVE-2026-91829
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers...
|
7.1 High | — | 0,16% | 11 Okt 2026 |
|
CVE-2026-89305
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQ...
|
6.5 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-89304
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform bli...
|
6.5 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-89302
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to pe...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89299
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perfo...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89297
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to per...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89287
The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers t...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89285
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated at...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89283
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-load...
|
8.6 High | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-89234
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additi...
|
8.6 High | — | 0,27% | 11 Okt 2026 |
|
CVE-2026-89232
The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append add...
|
8.6 High | — | 0,27% | 11 Okt 2026 |
|
CVE-2026-89214
The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attac...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89213
The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89195
The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated at...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-88930
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and e...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-88905
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowi...
|
8.8 High | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-88903
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content,...
|
8.8 High | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-88827
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administ...
|
8.8 High | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-88826
The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape tha...
|
8.8 High | — | 0,15% | 11 Okt 2026 |
|
CVE-2026-88785
The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto...
|
4.7 Medium | — | 0,09% | 11 Okt 2026 |
|
CVE-2026-87764
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it es...
|
8.8 High | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-87762
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it use...
|
8.8 High | — | 0,36% | 11 Okt 2026 |
|
CVE-2026-87761
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its sit...
|
8.0 High | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-87760
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and...
|
8.8 High | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-86798
The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them b...
|
8.8 High | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-86717
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary Wor...
|
9.1 Critical | — | 0,31% | 11 Okt 2026 |