Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 29 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-65538
Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
|
5.9 Medium | — | 0,24% | 23 Jul 2026 |
|
CVE-2026-65537
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.
|
4.3 Medium | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-65536
Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.
|
6.5 Medium | — | 0,17% | 23 Jul 2026 |
|
CVE-2026-65535
Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.
|
4.3 Medium | — | 0,30% | 23 Jul 2026 |
|
CVE-2026-65534
Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
|
5.9 Medium | — | 0,24% | 23 Jul 2026 |
|
CVE-2026-65533
Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65532
Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.
|
7.6 High | — | 0,38% | 23 Jul 2026 |
|
CVE-2026-65531
Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
|
4.8 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65530
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
|
4.3 Medium | — | 0,27% | 23 Jul 2026 |
|
CVE-2026-65529
Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Config...
|
5.3 Medium | — | 0,31% | 23 Jul 2026 |
|
CVE-2026-65528
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65527
Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65526
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection.
This issue affects...
|
8.5 High | — | 0,36% | 23 Jul 2026 |
|
CVE-2026-65525
Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-65524
Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.
|
4.3 Medium | — | 0,27% | 23 Jul 2026 |
|
CVE-2026-65522
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65521
Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.
|
5.3 Medium | — | 0,33% | 23 Jul 2026 |
|
CVE-2026-65519
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65518
Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65516
Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.
|
7.2 High | — | 0,27% | 23 Jul 2026 |
|
CVE-2026-65514
Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65512
Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery.
This issue affects...
|
5.4 Medium | — | 0,14% | 23 Jul 2026 |
|
CVE-2026-65511
Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-65510
Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-65506
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-65505
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
|
5.3 Medium | — | 0,33% | 23 Jul 2026 |
|
CVE-2026-65503
Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65501
Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.
|
5.3 Medium | — | 0,31% | 23 Jul 2026 |
|
CVE-2026-65500
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
|
7.5 High | — | 0,39% | 23 Jul 2026 |
|
CVE-2026-65499
Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.
|
6.5 Medium | — | 0,27% | 23 Jul 2026 |
|
CVE-2026-65498
Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.
|
5.3 Medium | — | 0,33% | 23 Jul 2026 |
|
CVE-2026-65497
Administrator PHP Object Injection in Complianz <= 7.5.0 versions.
|
7.2 High | — | 0,54% | 23 Jul 2026 |
|
CVE-2026-65496
Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.
|
4.4 Medium | — | 0,21% | 23 Jul 2026 |
|
CVE-2026-65495
Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.
|
7.5 High | — | 0,43% | 23 Jul 2026 |
|
CVE-2026-65494
Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.
|
7.1 High | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-65493
Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.
|
7.5 High | — | 0,40% | 23 Jul 2026 |
|
CVE-2026-65492
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS.
This issue affects Dokan Pro...
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-65491
Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.
|
4.3 Medium | — | 0,27% | 23 Jul 2026 |
|
CVE-2026-65490
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensiti...
|
5.3 Medium | — | 0,33% | 23 Jul 2026 |
|
CVE-2026-65489
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security...
|
5.3 Medium | — | 0,31% | 23 Jul 2026 |
|
CVE-2026-65488
Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Eleme...
|
7.1 High | — | 0,13% | 23 Jul 2026 |
|
CVE-2026-65487
Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-65486
Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.
|
5.3 Medium | — | 0,31% | 23 Jul 2026 |
|
CVE-2026-65485
Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.
|
5.3 Medium | — | 0,31% | 23 Jul 2026 |
|
CVE-2026-65484
Contributor Broken Access Control in Style Kits <= 2.6.5 versions.
|
6.3 Medium | — | 0,26% | 23 Jul 2026 |
|
CVE-2026-65483
Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
|
5.9 Medium | — | 0,24% | 23 Jul 2026 |
|
CVE-2026-65482
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit a...
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65481
Contributor Local File Inclusion in Vino <= 1.9 versions.
|
7.5 High | — | 0,43% | 23 Jul 2026 |
|
CVE-2026-65480
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS.
This issue affects TheGem:...
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-65479
Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.
|
5.4 Medium | — | 0,29% | 23 Jul 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.