Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-104629
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authe...
|
8.8 High | — | 0,34% | 9 Okt 2026 |
|
CVE-2026-101022
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticat...
|
4.3 Medium | — | 0,19% | 9 Okt 2026 |
|
CVE-2026-100730
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already...
|
9.8 Critical | — | 0,63% | 9 Okt 2026 |
|
CVE-2026-96396
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails...
|
4.9 Medium | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-96395
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affi...
|
3.6 Low | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-96394
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating Quick...
|
2.9 Low | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-96393
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds p...
|
3.6 Low | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-94062
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local F...
|
8.1 High | — | 0,34% | 9 Okt 2026 |
|
CVE-2026-94061
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflec...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-94060
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Vol...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-94059
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Oge...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-94058
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-86405
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing...
|
9.8 Critical | — | 0,20% | 9 Okt 2026 |
|
CVE-2026-8374
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulate...
|
8.5 High | — | 0,09% | 9 Okt 2026 |
|
CVE-2026-85531
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing b...
|
9.8 Critical | — | 0,20% | 9 Okt 2026 |
|
CVE-2026-62029
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affe...
|
6.5 Medium | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-62028
Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configure...
|
5.4 Medium | — | 0,14% | 9 Okt 2026 |
|
CVE-2026-106602
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: fro...
|
4.8 Medium | — | 0,18% | 9 Okt 2026 |
|
CVE-2026-106601
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: fro...
|
5.4 Medium | — | 0,18% | 9 Okt 2026 |
|
CVE-2026-105883
Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th...
|
7.1 High | — | 0,18% | 9 Okt 2026 |
|
CVE-2026-105877
Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA...
|
6.9 Medium | — | 0,25% | 9 Okt 2026 |
|
CVE-2026-105872
Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue...
|
7.2 High | — | 0,30% | 9 Okt 2026 |
|
CVE-2026-105870
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows R...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-105318
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-104392
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master:...
|
8.8 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-104079
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users...
|
4.3 Medium | — | 0,19% | 9 Okt 2026 |
|
CVE-2026-103413
Improper input validation vulnerability in Apache Camel Karavan.
When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every re...
|
8.8 High | — | 0,39% | 9 Okt 2026 |
|
CVE-2026-103412
Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan.
A project file name supplied through the project...
|
8.8 High | — | 0,52% | 9 Okt 2026 |
|
CVE-2026-103220
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files,...
|
4.5 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-101130
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files,...
|
3.6 Low | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-101094
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document...
|
3.6 Low | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-89235
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers...
|
6.8 Medium | — | 0,22% | 9 Okt 2026 |
|
CVE-2026-87846
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthe...
|
5.3 Medium | — | 0,18% | 9 Okt 2026 |
|
CVE-2026-86851
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation...
|
6.5 Medium | — | 0,16% | 9 Okt 2026 |
|
CVE-2026-85348
The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a...
|
4.3 Medium | — | 0,10% | 9 Okt 2026 |
|
CVE-2026-62042
Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This iss...
|
5.3 Medium | — | 0,19% | 9 Okt 2026 |
|
CVE-2026-62041
Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a...
|
5.4 Medium | — | 0,14% | 9 Okt 2026 |
|
CVE-2026-62040
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Acc...
|
5.3 Medium | — | 0,19% | 9 Okt 2026 |
|
CVE-2026-62039
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.Thi...
|
6.5 Medium | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-62036
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensi...
|
4.3 Medium | — | 0,18% | 9 Okt 2026 |
|
CVE-2026-39779
Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asga...
|
4.3 Medium | — | 0,16% | 9 Okt 2026 |
|
CVE-2026-107419
Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Contro...
|
5.4 Medium | — | 0,17% | 9 Okt 2026 |
|
CVE-2026-103329
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate...
|
5.3 Medium | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-96809
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Bli...
|
9.3 Critical | — | 0,24% | 9 Okt 2026 |
|
CVE-2026-96761
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issu...
|
7.1 High | — | 0,14% | 9 Okt 2026 |
|
CVE-2026-96671
Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured...
|
8.8 High | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-96607
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected X...
|
7.1 High | — | 0,14% | 9 Okt 2026 |
|
CVE-2026-96553
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-96539
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a t...
|
5.6 Medium | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-96518
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec...
|
5.9 Medium | — | 0,18% | 9 Okt 2026 |