Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-62032
Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.
|
9.8 Critical | — | 0,35% | 10 Okt 2026 |
|
CVE-2026-62031
Unauthenticated SQL Injection in uListing <= 2.2.0 versions.
|
9.3 Critical | — | 0,29% | 10 Okt 2026 |
|
CVE-2026-62030
Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.
|
7.2 High | — | 0,19% | 10 Okt 2026 |
|
CVE-2026-62027
Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-62025
Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.
|
9.0 Critical | — | 0,29% | 10 Okt 2026 |
|
CVE-2026-62024
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
|
9.9 Critical | — | 0,45% | 10 Okt 2026 |
|
CVE-2026-62022
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
|
9.8 Critical | — | 0,33% | 10 Okt 2026 |
|
CVE-2026-62021
Subscriber PHP Object Injection in Angio <= 1.1.1 versions.
|
8.8 High | — | 0,48% | 10 Okt 2026 |
|
CVE-2026-62020
Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
|
8.1 High | — | 0,35% | 10 Okt 2026 |
|
CVE-2026-57742
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS.
This issue affects...
|
7.1 High | — | 0,15% | 10 Okt 2026 |
|
CVE-2026-48194
Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.
|
8.1 High | — | 0,35% | 10 Okt 2026 |
|
CVE-2026-48193
Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.
|
8.1 High | — | 0,35% | 10 Okt 2026 |
|
CVE-2026-45440
Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
|
7.6 High | — | 0,28% | 10 Okt 2026 |
|
CVE-2026-42777
Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.
|
8.1 High | — | 0,35% | 10 Okt 2026 |
|
CVE-2026-42724
Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
|
8.1 High | — | 0,35% | 10 Okt 2026 |
|
CVE-2026-42723
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
|
9.8 Critical | — | 0,39% | 10 Okt 2026 |
|
CVE-2026-42722
Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.
|
7.6 High | — | 0,28% | 10 Okt 2026 |
|
CVE-2026-42719
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
|
9.8 Critical | — | 0,53% | 10 Okt 2026 |
|
CVE-2026-42718
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
|
9.8 Critical | — | 0,39% | 10 Okt 2026 |
|
CVE-2026-42717
Administrator SQL Injection in Leyka <= 3.32.3 versions.
|
7.6 High | — | 0,28% | 10 Okt 2026 |
|
CVE-2026-42716
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
|
9.8 Critical | — | 0,39% | 10 Okt 2026 |
|
CVE-2026-42715
Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-42712
Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.
|
8.5 High | — | 0,34% | 10 Okt 2026 |
|
CVE-2026-42711
Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-42709
Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-42706
Unauthenticated Broken Access Control in DK <= 3.2.1 versions.
|
7.5 High | — | 0,25% | 10 Okt 2026 |
|
CVE-2026-42705
Unauthenticated Broken Access Control in Grand News <= 3.4 versions.
|
7.5 High | — | 0,25% | 10 Okt 2026 |
|
CVE-2026-42704
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
|
8.1 High | — | 0,35% | 10 Okt 2026 |
|
CVE-2026-42702
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tuto...
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-42699
Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-42697
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-med...
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-42696
Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-mig...
|
10.0 Critical | — | 0,39% | 10 Okt 2026 |
|
CVE-2026-42693
Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-42633
Subscriber SQL Injection in Events Manager <= 7.4.6 versions.
|
8.5 High | — | 0,34% | 10 Okt 2026 |
|
CVE-2026-42632
Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-42631
Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-42630
Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.
|
7.5 High | — | 0,30% | 10 Okt 2026 |
|
CVE-2026-42419
Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.
|
5.9 Medium | — | 0,26% | 10 Okt 2026 |
|
CVE-2026-40808
Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
|
6.5 Medium | — | 0,28% | 10 Okt 2026 |
|
CVE-2026-40805
Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.
|
7.7 High | — | 0,45% | 10 Okt 2026 |
|
CVE-2026-40803
Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-40802
Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions.
|
7.6 High | — | 0,29% | 10 Okt 2026 |
|
CVE-2026-40801
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
|
8.1 High | — | 0,33% | 10 Okt 2026 |
|
CVE-2026-40800
Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.
|
9.3 Critical | — | 0,38% | 10 Okt 2026 |
|
CVE-2026-40777
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
|
8.1 High | — | 0,35% | 10 Okt 2026 |
|
CVE-2026-39802
Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.
|
8.1 High | — | 0,46% | 10 Okt 2026 |
|
CVE-2026-39801
Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.
|
9.8 Critical | — | 0,45% | 10 Okt 2026 |
|
CVE-2026-39800
Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-39799
Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
|
7.1 High | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-27350
Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery.
This issue affects Builderius: from 1.4 through 1.4-beta...
|
7.2 High | — | 0,16% | 10 Okt 2026 |