Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 29 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-17529
A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the a...
|
6.3 Medium | — | 0,37% | 27 Jul 2026 |
|
CVE-2026-16812
arista velocloud orchestrator
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host...
|
10.0 Critical | KEV | 1,8% | 27 Jul 2026 |
|
CVE-2025-50455
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from...
|
9.1 Critical | — | 1,1% | 27 Jul 2026 |
|
CVE-2026-66477
Unauthenticated Broken Access Control in Gillion <= 4.13 versions.
|
5.3 Medium | — | 0,29% | 27 Jul 2026 |
|
CVE-2026-66476
Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.
|
4.9 Medium | — | 0,50% | 27 Jul 2026 |
|
CVE-2026-66475
Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions.
|
5.9 Medium | — | 0,24% | 27 Jul 2026 |
|
CVE-2026-66474
Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.
|
4.3 Medium | — | 0,14% | 27 Jul 2026 |
|
CVE-2026-66448
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.
|
6.5 Medium | — | 0,22% | 27 Jul 2026 |
|
CVE-2026-66445
Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.
|
6.5 Medium | — | 0,22% | 27 Jul 2026 |
|
CVE-2026-66442
Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.
|
5.4 Medium | — | 0,29% | 27 Jul 2026 |
|
CVE-2026-66438
Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.
|
5.3 Medium | — | 0,33% | 27 Jul 2026 |
|
CVE-2026-66437
Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.
|
4.9 Medium | — | 0,19% | 27 Jul 2026 |
|
CVE-2026-66434
Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.
|
6.5 Medium | — | 0,22% | 27 Jul 2026 |
|
CVE-2026-66433
Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.
|
6.5 Medium | — | 0,22% | 27 Jul 2026 |
|
CVE-2026-66428
Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.
|
4.3 Medium | — | 0,14% | 27 Jul 2026 |
|
CVE-2026-66427
Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.
|
7.6 High | — | 0,38% | 27 Jul 2026 |
|
CVE-2026-66050
NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to writ...
|
7.5 High | — | 1,1% | 27 Jul 2026 |
|
CVE-2026-65568
Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.
|
5.0 Medium | — | 0,28% | 27 Jul 2026 |
|
CVE-2026-65567
Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.
|
5.3 Medium | — | 0,29% | 27 Jul 2026 |
|
CVE-2026-65564
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.
|
5.3 Medium | — | 0,33% | 27 Jul 2026 |
|
CVE-2026-65563
Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.
|
5.9 Medium | — | 0,24% | 27 Jul 2026 |
|
CVE-2026-65562
Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.
|
6.5 Medium | — | 0,22% | 27 Jul 2026 |
|
CVE-2026-65561
Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.
|
6.5 Medium | — | 0,22% | 27 Jul 2026 |
|
CVE-2026-65558
Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.
|
5.4 Medium | — | 0,22% | 27 Jul 2026 |
|
CVE-2026-65557
Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.
|
5.9 Medium | — | 0,24% | 27 Jul 2026 |
|
CVE-2026-65436
Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.
|
6.8 Medium | — | 0,50% | 27 Jul 2026 |
|
CVE-2026-65435
Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.
|
6.5 Medium | — | 0,33% | 27 Jul 2026 |
|
CVE-2026-65434
Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.
|
6.5 Medium | — | 0,37% | 27 Jul 2026 |
|
CVE-2026-65433
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
|
6.5 Medium | — | 0,30% | 27 Jul 2026 |
|
CVE-2026-59560
Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.
|
6.5 Medium | — | 0,37% | 27 Jul 2026 |
|
CVE-2026-59559
Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
|
6.5 Medium | — | 0,22% | 27 Jul 2026 |
|
CVE-2026-59558
Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.
|
7.1 High | — | 0,25% | 27 Jul 2026 |
|
CVE-2026-59557
Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.
|
6.5 Medium | — | 0,33% | 27 Jul 2026 |
|
CVE-2026-59556
Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.
|
7.1 High | — | 0,25% | 27 Jul 2026 |
|
CVE-2026-59553
Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.
|
7.1 High | — | 0,25% | 27 Jul 2026 |
|
CVE-2026-59552
Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.
|
7.2 High | — | 0,27% | 27 Jul 2026 |
|
CVE-2026-59551
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
|
8.5 High | — | 0,36% | 27 Jul 2026 |
|
CVE-2026-59550
Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.
|
9.3 Critical | — | 0,40% | 27 Jul 2026 |
|
CVE-2026-59549
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
|
9.3 Critical | — | 0,40% | 27 Jul 2026 |
|
CVE-2026-59548
Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions.
|
7.5 High | — | 0,42% | 27 Jul 2026 |
|
CVE-2026-59546
Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.
|
7.4 High | — | 0,39% | 27 Jul 2026 |
|
CVE-2026-59539
Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.
|
7.5 High | — | 0,35% | 27 Jul 2026 |
|
CVE-2026-59538
Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.
|
9.3 Critical | — | 0,40% | 27 Jul 2026 |
|
CVE-2026-59537
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.
|
7.6 High | — | 0,38% | 27 Jul 2026 |
|
CVE-2026-59536
Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.
|
7.5 High | — | 0,35% | 27 Jul 2026 |
|
CVE-2026-59535
Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.
|
7.3 High | — | 0,30% | 27 Jul 2026 |
|
CVE-2026-59534
Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.
|
7.5 High | — | 0,35% | 27 Jul 2026 |
|
CVE-2026-59533
Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.
|
9.3 Critical | — | 0,40% | 27 Jul 2026 |
|
CVE-2026-59532
Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.
|
7.5 High | — | 0,37% | 27 Jul 2026 |
|
CVE-2026-59531
Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions.
|
7.5 High | — | 0,46% | 27 Jul 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.