Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-86706
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is writ...
|
9.1 Critical | — | 0,31% | 11 Okt 2026 |
|
CVE-2026-85126
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to...
|
7.2 High | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-85121
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite...
|
9.1 Critical | — | 0,31% | 11 Okt 2026 |
|
CVE-2026-85118
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users...
|
9.8 Critical | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-84737
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as...
|
9.8 Critical | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-84734
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating...
|
9.8 Critical | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-84261
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputtin...
|
8.8 High | — | 0,30% | 11 Okt 2026 |
|
CVE-2026-84260
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting...
|
8.8 High | — | 0,30% | 11 Okt 2026 |
|
CVE-2026-84259
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it ba...
|
8.8 High | — | 0,30% | 11 Okt 2026 |
|
CVE-2026-84258
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting i...
|
8.8 High | — | 0,30% | 11 Okt 2026 |
|
CVE-2026-84254
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not...
|
9.8 Critical | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-84253
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not...
|
9.8 Critical | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-84252
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure...
|
9.8 Critical | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-84251
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not en...
|
9.8 Critical | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-81649
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is i...
|
9.1 Critical | — | 0,29% | 11 Okt 2026 |
|
CVE-2026-81420
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowi...
|
8.6 High | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-81156
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing user...
|
6.8 Medium | — | 0,29% | 11 Okt 2026 |
|
CVE-2026-81155
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author rol...
|
6.8 Medium | — | 0,29% | 11 Okt 2026 |
|
CVE-2026-81154
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Au...
|
6.8 Medium | — | 0,29% | 11 Okt 2026 |
|
CVE-2026-81153
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the...
|
6.8 Medium | — | 0,29% | 11 Okt 2026 |
|
CVE-2026-14854
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions...
|
7.5 High | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-12980
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contr...
|
6.8 Medium | — | 0,29% | 11 Okt 2026 |
|
CVE-2026-107694
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested fo...
|
2.7 Low | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-107507
The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to chan...
|
2.7 Low | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108541
A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulat...
|
6.3 Medium | — | 0,24% | 11 Okt 2026 |
|
CVE-2026-108540
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipula...
|
9.9 Critical | — | 1,7% | 11 Okt 2026 |
|
CVE-2026-106029
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing un...
|
7.5 High | — | 0,25% | 11 Okt 2026 |
|
CVE-2026-104684
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose o...
|
2.7 Low | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-104682
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbi...
|
2.7 Low | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-104681
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to vie...
|
2.7 Low | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-104680
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin bef...
|
7.2 High | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-104028
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied co...
|
9.8 Critical | — | 0,55% | 11 Okt 2026 |
|
CVE-2026-103695
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform S...
|
8.6 High | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-103694
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any...
|
8.8 High | — | 0,29% | 11 Okt 2026 |
|
CVE-2026-103305
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting the...
|
8.8 High | — | 0,17% | 11 Okt 2026 |
|
CVE-2026-108539
A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manip...
|
6.3 Medium | — | 0,30% | 11 Okt 2026 |
|
CVE-2026-108538
A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such...
|
6.3 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-108523
A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Br...
|
4.3 Medium | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-108522
A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a man...
|
8.3 High | — | 0,42% | 11 Okt 2026 |
|
CVE-2026-108521
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts o...
|
4.7 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-108708
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil da...
|
8.8 High | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-108707
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by o...
|
9.8 Critical | — | 0,55% | 11 Okt 2026 |
|
CVE-2026-108706
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored objec...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108705
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into a...
|
4.3 Medium | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-108704
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field...
|
4.3 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-108703
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval...
|
5.4 Medium | — | 0,17% | 11 Okt 2026 |
|
CVE-2026-108702
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side re...
|
4.3 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-108701
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any per...
|
4.3 Medium | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-108700
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/bus...
|
6.5 Medium | — | 0,24% | 11 Okt 2026 |
|
CVE-2026-108696
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supp...
|
4.3 Medium | — | 0,22% | 11 Okt 2026 |