Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-94676
Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.
|
7.2 High | — | 0,30% | 10 Okt 2026 |
|
CVE-2026-66435
Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Roll...
|
5.9 Medium | — | 0,21% | 10 Okt 2026 |
|
CVE-2026-108165
Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset m...
|
4.3 Medium | — | 0,20% | 10 Okt 2026 |
|
CVE-2026-108164
Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticate...
|
6.5 Medium | — | 0,26% | 10 Okt 2026 |
|
CVE-2026-108163
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unaut...
|
6.5 Medium | — | 0,22% | 10 Okt 2026 |
|
CVE-2026-108162
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main....
|
6.5 Medium | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-108161
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing...
|
7.5 High | — | 1,1% | 10 Okt 2026 |
|
CVE-2026-105885
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
|
8.8 High | — | 0,29% | 10 Okt 2026 |
|
CVE-2026-102388
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects...
|
7.1 High | — | 0,15% | 10 Okt 2026 |
|
CVE-2026-108506
ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflectio...
|
5.5 Medium | — | 0,15% | 10 Okt 2026 |
|
CVE-2026-106139
In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as...
|
5.4 Medium | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-106138
In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw...
|
5.4 Medium | — | 0,18% | 10 Okt 2026 |
|
CVE-2026-91136
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/di...
|
7.5 High | — | 1,8% | 10 Okt 2026 |
|
CVE-2026-4791
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versi...
|
6.4 Medium | — | 0,19% | 10 Okt 2026 |
|
CVE-2026-108505
ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related informati...
|
3.3 Low | — | 0,11% | 10 Okt 2026 |
|
CVE-2026-107657
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute fie...
|
7.2 High | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-104722
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valid...
|
4.9 Medium | — | 0,64% | 10 Okt 2026 |
|
CVE-2026-97396
The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions u...
|
6.4 Medium | — | 0,20% | 10 Okt 2026 |
|
CVE-2026-97340
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link co...
|
6.4 Medium | — | 0,16% | 10 Okt 2026 |
|
CVE-2026-96765
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in...
|
7.2 High | — | 0,32% | 10 Okt 2026 |
|
CVE-2026-96662
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Par...
|
7.5 High | — | 0,39% | 10 Okt 2026 |
|
CVE-2026-96653
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_name' Profile Field (Second-Order) in all versions up to, and including,...
|
6.5 Medium | — | 0,25% | 10 Okt 2026 |
|
CVE-2026-96563
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up...
|
6.4 Medium | — | 0,20% | 10 Okt 2026 |
|
CVE-2026-96278
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002...
|
7.2 High | — | 0,25% | 10 Okt 2026 |
|
CVE-2026-93951
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zei...
|
7.1 High | — | 0,15% | 10 Okt 2026 |
|
CVE-2026-93950
Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: fro...
|
7.5 High | — | 0,20% | 10 Okt 2026 |
|
CVE-2026-93949
Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation....
|
7.1 High | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-93945
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
|
9.8 Critical | — | 0,33% | 10 Okt 2026 |
|
CVE-2026-93944
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-93943
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-93942
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-93941
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
|
9.8 Critical | — | 0,33% | 10 Okt 2026 |
|
CVE-2026-93940
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
|
9.8 Critical | — | 0,33% | 10 Okt 2026 |
|
CVE-2026-93938
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
|
9.8 Critical | — | 0,33% | 10 Okt 2026 |
|
CVE-2026-93937
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
|
9.8 Critical | — | 0,33% | 10 Okt 2026 |
|
CVE-2026-93936
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
|
9.8 Critical | — | 0,33% | 10 Okt 2026 |
|
CVE-2026-93935
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-93934
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-93933
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-93932
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-93931
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-93930
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-93929
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
|
9.8 Critical | — | 0,32% | 10 Okt 2026 |
|
CVE-2026-93927
Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
|
9.8 Critical | — | 0,32% | 10 Okt 2026 |
|
CVE-2026-93746
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions...
|
7.5 High | — | 0,53% | 10 Okt 2026 |
|
CVE-2026-62046
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
|
9.8 Critical | — | 0,32% | 10 Okt 2026 |
|
CVE-2026-62045
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
|
9.8 Critical | — | 0,32% | 10 Okt 2026 |
|
CVE-2026-108504
ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this...
|
5.5 Medium | — | 0,12% | 10 Okt 2026 |
|
CVE-2026-106606
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerc...
|
7.2 High | — | 0,37% | 10 Okt 2026 |
|
CVE-2026-104803
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the soci...
|
9.8 Critical | — | 0,45% | 10 Okt 2026 |