Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 29 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-57808
Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.
|
6.5 Medium | — | 0,30% | 23 Jul 2026 |
|
CVE-2026-57785
Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.
|
8.8 High | — | 0,20% | 23 Jul 2026 |
|
CVE-2026-57784
Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
|
9.6 Critical | — | 0,20% | 23 Jul 2026 |
|
CVE-2026-57769
Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57767
Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57735
Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57717
Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.
|
6.5 Medium | — | 0,33% | 23 Jul 2026 |
|
CVE-2026-57716
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
|
5.3 Medium | — | 0,38% | 23 Jul 2026 |
|
CVE-2026-57704
Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57703
Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
|
6.3 Medium | — | 0,26% | 23 Jul 2026 |
|
CVE-2026-57701
Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57699
Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57696
Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
|
7.1 High | — | 0,41% | 23 Jul 2026 |
|
CVE-2026-57626
Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery.
This issue affects MailPoet: from 5.30.0 through 5.33.0.
|
7.1 High | — | 0,13% | 23 Jul 2026 |
|
CVE-2026-57428
Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57427
Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57425
Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.
|
6.5 Medium | — | 0,33% | 23 Jul 2026 |
|
CVE-2026-57397
Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57384
Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-57374
Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57373
Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-57370
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.
|
7.1 High | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-57367
Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.
|
7.1 High | — | 0,34% | 23 Jul 2026 |
|
CVE-2026-27423
Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.
|
4.3 Medium | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-27422
Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player:...
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-27418
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-27403
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS.
This issue affects Hubbub...
|
6.5 Medium | — | 0,22% | 23 Jul 2026 |
|
CVE-2026-27399
Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.
|
5.3 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-27392
Contributor Broken Access Control in uListing <= 2.2.0 versions.
|
4.3 Medium | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-27391
Subscriber Broken Access Control in uListing <= 2.2.0 versions.
|
5.4 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-27377
Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.
|
6.7 Medium | — | 0,38% | 23 Jul 2026 |
|
CVE-2026-27372
Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.
|
6.5 Medium | — | 0,37% | 23 Jul 2026 |
|
CVE-2026-27355
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
|
5.3 Medium | — | 0,38% | 23 Jul 2026 |
|
CVE-2026-27064
Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.
|
9.1 Critical | — | 0,50% | 23 Jul 2026 |
|
CVE-2026-25466
Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.
|
5.3 Medium | — | 0,31% | 23 Jul 2026 |
|
CVE-2026-25427
Subscriber Broken Access Control in eRoom <= 1.7.1 versions.
|
5.4 Medium | — | 0,29% | 23 Jul 2026 |
|
CVE-2026-25424
Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.
|
4.3 Medium | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-25405
Contributor SQL Injection in eRoom <= 1.7.1 versions.
|
8.5 High | — | 0,36% | 23 Jul 2026 |
|
CVE-2026-24639
Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.
|
4.4 Medium | — | 0,21% | 23 Jul 2026 |
|
CVE-2026-24628
Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.
|
5.9 Medium | — | 0,24% | 23 Jul 2026 |
|
CVE-2026-24552
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injec...
|
8.5 High | — | 0,36% | 23 Jul 2026 |
|
CVE-2026-24537
Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.
|
4.3 Medium | — | 0,14% | 23 Jul 2026 |
|
CVE-2025-68081
Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.
|
5.9 Medium | — | 0,24% | 23 Jul 2026 |
|
CVE-2026-64611
A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an e...
|
7.5 High | — | 0,63% | 23 Jul 2026 |
|
CVE-2026-16745
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can b...
|
8.8 High | — | 0,47% | 23 Jul 2026 |
|
CVE-2026-65758
Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthen...
|
8.2 High | — | 0,31% | 23 Jul 2026 |
|
CVE-2026-65757
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module dat...
|
8.1 High | — | 0,19% | 23 Jul 2026 |
|
CVE-2026-65756
Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.
|
6.1 Medium | — | 0,25% | 23 Jul 2026 |
|
CVE-2026-65755
Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain...
|
7.5 High | — | 0,42% | 23 Jul 2026 |
|
CVE-2026-65754
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory.
|
7.5 High | — | 0,50% | 23 Jul 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.