Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-108107
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into...
|
9.8 Critical | — | 0,41% | 9 Okt 2026 |
|
CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed len...
|
7.5 High | — | 0,37% | 9 Okt 2026 |
|
CVE-2026-108105
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME v...
|
5.9 Medium | — | 0,52% | 9 Okt 2026 |
|
CVE-2026-108104
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement all...
|
4.8 Medium | — | 0,22% | 9 Okt 2026 |
|
CVE-2026-108103
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to re...
|
5.3 Medium | — | 0,39% | 9 Okt 2026 |
|
CVE-2026-108102
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c that allows remote unauthenticated attac...
|
5.3 Medium | — | 0,39% | 9 Okt 2026 |
|
CVE-2026-108101
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with clien...
|
7.5 High | — | 0,39% | 9 Okt 2026 |
|
CVE-2026-108100
HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /...
|
6.5 Medium | — | 0,27% | 9 Okt 2026 |
|
CVE-2026-107806
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-contro...
|
9.4 Critical | — | 0,33% | 9 Okt 2026 |
|
CVE-2026-107805
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-c...
|
7.5 High | — | 0,44% | 9 Okt 2026 |
|
CVE-2026-107804
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin be...
|
5.3 Medium | — | 0,22% | 9 Okt 2026 |
|
CVE-2026-105278
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management in...
|
9.8 Critical | — | 0,34% | 9 Okt 2026 |
|
CVE-2026-104117
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd...
|
1.9 Low | — | 0,11% | 9 Okt 2026 |
|
CVE-2026-104116
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which...
|
1.9 Low | — | 0,11% | 9 Okt 2026 |
|
CVE-2026-104115
A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/...
|
5.4 Medium | — | 0,14% | 9 Okt 2026 |
|
CVE-2026-104114
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd...
|
5.4 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-104113
A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface...
|
5.4 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-104112
A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in...
|
6.8 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-104081
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str...
|
8.1 High | — | 0,77% | 9 Okt 2026 |
|
CVE-2026-102916
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses gue...
|
6.8 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-94067
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local F...
|
8.1 High | — | 0,34% | 9 Okt 2026 |
|
CVE-2026-94066
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: fro...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-94065
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.
|
8.8 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-94064
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop Word...
|
8.8 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-94063
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-92085
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Manag...
|
5.4 Medium | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-85479
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect...
|
5.3 Medium | — | 0,25% | 9 Okt 2026 |
|
CVE-2026-79363
Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML con...
|
5.9 Medium | — | 0,18% | 9 Okt 2026 |
|
CVE-2026-62026
Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from...
|
7.1 High | — | 0,09% | 9 Okt 2026 |
|
CVE-2026-108063
A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a spe...
|
5.5 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-107803
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection th...
|
6.5 Medium | — | 0,25% | 9 Okt 2026 |
|
CVE-2026-107785
Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is...
|
6.3 Medium | — | 0,14% | 9 Okt 2026 |
|
CVE-2026-106581
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide...
|
7.3 High | — | 0,08% | 9 Okt 2026 |
|
CVE-2026-105281
The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to...
|
7.5 High | — | 0,31% | 9 Okt 2026 |
|
CVE-2026-104629
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authe...
|
8.8 High | — | 0,34% | 9 Okt 2026 |
|
CVE-2026-101022
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticat...
|
4.3 Medium | — | 0,19% | 9 Okt 2026 |
|
CVE-2026-100730
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already...
|
9.8 Critical | — | 0,63% | 9 Okt 2026 |
|
CVE-2026-96396
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails...
|
4.9 Medium | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-96395
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affi...
|
3.6 Low | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-96394
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating Quick...
|
2.9 Low | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-96393
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds p...
|
3.6 Low | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-94062
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local F...
|
8.1 High | — | 0,34% | 9 Okt 2026 |
|
CVE-2026-94061
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflec...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-94060
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Vol...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-94059
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Oge...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-94058
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-86405
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing...
|
9.8 Critical | — | 0,20% | 9 Okt 2026 |
|
CVE-2026-8374
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulate...
|
8.5 High | — | 0,09% | 9 Okt 2026 |
|
CVE-2026-85531
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing b...
|
9.8 Critical | — | 0,20% | 9 Okt 2026 |
|
CVE-2026-62029
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affe...
|
6.5 Medium | — | 0,13% | 9 Okt 2026 |