Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-97031
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in th...
|
7.5 High | — | 0,39% | 8 Okt 2026 |
|
CVE-2026-97030
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid key...
|
6.1 Medium | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-94448
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that...
|
6.1 Medium | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses...
|
7.8 High | — | 0,13% | 8 Okt 2026 |
|
CVE-2026-94444
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to c...
|
7.8 High | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-96207
microsoft partner center
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
|
10.0 Critical | — | 0,48% | 8 Okt 2026 |
|
CVE-2026-94510
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
|
9.9 Critical | — | 0,40% | 8 Okt 2026 |
|
CVE-2026-94440
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
|
7.5 High | — | 0,40% | 8 Okt 2026 |
|
CVE-2026-94439
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and se...
|
7.5 High | — | 0,32% | 8 Okt 2026 |
|
CVE-2026-78669
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames conta...
|
7.5 High | — | 0,57% | 8 Okt 2026 |
|
CVE-2026-88131
microsoft dataverse
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 0,84% | 8 Okt 2026 |
|
CVE-2026-83947
microsoft azure event grid
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.
|
6.5 Medium | — | 0,37% | 8 Okt 2026 |
|
CVE-2026-83943
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
|
8.7 High | — | 0,38% | 8 Okt 2026 |
|
CVE-2026-78667
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
|
7.5 High | — | 0,38% | 8 Okt 2026 |
|
CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of...
|
9.1 Critical | — | 0,57% | 8 Okt 2026 |
|
CVE-2026-78660
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this ma...
|
7.5 High | — | 0,30% | 8 Okt 2026 |
|
CVE-2026-78659
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because R...
|
7.5 High | — | 0,57% | 8 Okt 2026 |
|
CVE-2026-77900
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 0,49% | 8 Okt 2026 |
|
CVE-2026-69435
microsoft azure sre agent
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
|
8.1 High | — | 0,39% | 8 Okt 2026 |
|
CVE-2026-56866
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers...
|
7.5 High | — | 0,31% | 8 Okt 2026 |
|
CVE-2026-56857
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even w...
|
9.8 Critical | — | 0,49% | 8 Okt 2026 |
|
CVE-2026-107802
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lin...
|
7.1 High | — | 0,14% | 8 Okt 2026 |
|
CVE-2026-107738
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to sig...
|
6.8 Medium | — | 0,12% | 8 Okt 2026 |
|
CVE-2026-107737
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accept...
|
5.7 Medium | — | 0,12% | 8 Okt 2026 |
|
CVE-2026-107736
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through Get...
|
6.8 Medium | — | 0,12% | 8 Okt 2026 |
|
CVE-2026-107735
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::A...
|
5.4 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-107734
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external...
|
7.1 High | — | 0,14% | 8 Okt 2026 |
|
CVE-2026-107733
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which deref...
|
6.8 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-107732
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip...
|
8.4 High | — | 0,13% | 8 Okt 2026 |
|
CVE-2026-107731
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets an...
|
5.5 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-107730
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset...
|
5.5 Medium | — | 0,12% | 8 Okt 2026 |
|
CVE-2026-107729
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; v...
|
5.5 Medium | — | 0,15% | 8 Okt 2026 |
|
CVE-2026-107728
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result...
|
7.5 High | — | 0,35% | 8 Okt 2026 |
|
CVE-2026-107727
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/gr...
|
3.7 Low | — | 0,35% | 8 Okt 2026 |
|
CVE-2026-107651
A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks....
|
5.5 Medium | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-105674
TP-Link Tapo
C325WB V2 generates the pre-shared key used by its local media streaming
service with a time-seeded pseudo-random number generator, making the key
predictabl...
|
8.7 High | — | 0,20% | 8 Okt 2026 |
|
CVE-2026-105673
An
unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the
RTSP streaming service on TCP port 554 when the Camera Account feature is
enabled. A cr...
|
7.1 High | — | 0,20% | 8 Okt 2026 |
|
CVE-2026-105672
TP-Link Tapo
C325WB V2 contains an unauthenticated authorization bypass vulnerability in the
HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent networ...
|
8.7 High | — | 0,25% | 8 Okt 2026 |
|
CVE-2026-89091
A flaw was found in ansible-core. When installing a collection with
`ansible-galaxy collection install`, the archive extractor validates member
paths using lexical path n...
|
8.8 High | — | 0,48% | 8 Okt 2026 |
|
CVE-2026-87980
ibm guardium data protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs.
|
5.5 Medium | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-84891
ibm guardium data protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials.
|
7.5 High | — | 0,30% | 8 Okt 2026 |
|
CVE-2026-84875
ibm guardium data protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
|
8.8 High | — | 0,42% | 8 Okt 2026 |
|
CVE-2026-84249
ibm guardium data protection
IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...
|
9.8 Critical | — | 0,41% | 8 Okt 2026 |
|
CVE-2026-84247
ibm guardium data protection
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
|
6.5 Medium | — | 0,39% | 8 Okt 2026 |
|
CVE-2026-84246
ibm guardium data protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
|
9.8 Critical | — | 0,38% | 8 Okt 2026 |
|
CVE-2026-84230
ibm guardium data protection
IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to...
|
5.9 Medium | — | 0,26% | 8 Okt 2026 |
|
CVE-2026-84209
ibm guardium data protection
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in a...
|
9.8 Critical | — | 0,32% | 8 Okt 2026 |
|
CVE-2026-84198
ibm guardium data protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
|
9.8 Critical | — | 0,38% | 8 Okt 2026 |
|
CVE-2026-84058
ibm guardium data protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can s...
|
9.8 Critical | — | 0,37% | 8 Okt 2026 |
|
CVE-2026-84057
ibm guardium data protection
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS...
|
9.8 Critical | — | 0,39% | 8 Okt 2026 |