Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-104075
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tv...
|
9.8 Critical | — | 0,56% | 8 Okt 2026 |
|
CVE-2026-95209
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).
|
7.5 High | — | 0,28% | 8 Okt 2026 |
|
CVE-2026-84290
ibm guardium data protection
IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCT...
|
5.1 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-84278
ibm guardium data protection
IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user ca...
|
7.2 High | — | 2,2% | 8 Okt 2026 |
|
CVE-2026-84276
ibm guardium data protection
IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the...
|
7.5 High | — | 0,33% | 8 Okt 2026 |
|
CVE-2026-67693
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combinatio...
|
7.5 High | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-40804
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects...
|
7.1 High | — | 0,15% | 8 Okt 2026 |
|
CVE-2026-107704
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute command...
|
9.8 Critical | — | 1,7% | 8 Okt 2026 |
|
CVE-2026-107703
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath a...
|
9.8 Critical | — | 1,8% | 8 Okt 2026 |
|
CVE-2026-107701
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attack...
|
8.2 High | — | 0,33% | 8 Okt 2026 |
|
CVE-2026-107700
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is...
|
9.8 Critical | — | 0,50% | 8 Okt 2026 |
|
CVE-2026-107699
ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output p...
|
9.8 Critical | — | 1,5% | 8 Okt 2026 |
|
CVE-2026-107388
borewit music-metadata
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag...
|
5.5 Medium | — | 0,14% | 8 Okt 2026 |
|
CVE-2026-107387
borewit music-metadata
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Ar...
|
5.5 Medium | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-107386
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune comple...
|
6.3 Medium | — | 0,49% | 8 Okt 2026 |
|
CVE-2026-107385
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol esca...
|
7.4 High | — | 0,44% | 8 Okt 2026 |
|
CVE-2026-107384
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applicatio...
|
8.1 High | — | 0,45% | 8 Okt 2026 |
|
CVE-2026-107383
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygo...
|
7.5 High | — | 0,39% | 8 Okt 2026 |
|
CVE-2026-107382
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerpr...
|
5.9 Medium | — | 0,24% | 8 Okt 2026 |
|
CVE-2026-107325
Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or...
|
5.9 Medium | — | 0,24% | 8 Okt 2026 |
|
CVE-2026-107324
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document....
|
5.9 Medium | — | 0,23% | 8 Okt 2026 |
|
CVE-2026-107322
An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitra...
|
7.8 High | — | 0,13% | 8 Okt 2026 |
|
CVE-2026-106438
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them....
|
4.0 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-106437
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow u...
|
6.2 Medium | — | 0,10% | 8 Okt 2026 |
|
CVE-2026-106434
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who ca...
|
4.3 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-106433
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing dupli...
|
8.8 High | — | 0,27% | 8 Okt 2026 |
|
CVE-2026-106431
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific...
|
5.7 Medium | — | 0,10% | 8 Okt 2026 |
|
CVE-2026-106430
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the...
|
5.9 Medium | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-106429
An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur wh...
|
6.5 Medium | — | 0,29% | 8 Okt 2026 |
|
CVE-2026-106428
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-fin...
|
3.7 Low | — | 0,24% | 8 Okt 2026 |
|
CVE-2026-105570
Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS ho...
|
6.7 Medium | — | 0,13% | 8 Okt 2026 |
|
CVE-2026-105452
Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials only when th...
|
5.9 Medium | — | 0,14% | 8 Okt 2026 |
|
CVE-2026-101998
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers...
|
5.9 Medium | — | 0,16% | 8 Okt 2026 |
|
CVE-2026-97147
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it...
|
7.2 High | — | 0,29% | 8 Okt 2026 |
|
CVE-2026-95210
Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.
|
9.1 Critical | — | 0,23% | 8 Okt 2026 |
|
CVE-2026-95184
Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).
|
7.5 High | — | 0,22% | 8 Okt 2026 |
|
CVE-2026-93861
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membershi...
|
6.0 Medium | — | 0,26% | 8 Okt 2026 |
|
CVE-2026-93860
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforceme...
|
7.1 High | — | 0,34% | 8 Okt 2026 |
|
CVE-2026-93858
In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection...
|
8.7 High | — | 0,43% | 8 Okt 2026 |
|
CVE-2026-107702
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to ac...
|
4.3 Medium | — | 0,34% | 8 Okt 2026 |
|
CVE-2026-107698
ffmpeg
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects...
|
5.4 Medium | — | 0,26% | 8 Okt 2026 |
|
CVE-2026-107697
ffmpeg
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening c...
|
4.3 Medium | — | 0,32% | 8 Okt 2026 |
|
CVE-2026-107696
ffmpeg
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attack...
|
6.5 Medium | — | 0,35% | 8 Okt 2026 |
|
CVE-2026-107695
ffmpeg
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Ma...
|
6.5 Medium | — | 0,46% | 8 Okt 2026 |
|
CVE-2026-107380
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serialize...
|
5.4 Medium | — | 0,21% | 8 Okt 2026 |
|
CVE-2026-107379
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() per...
|
6.5 Medium | — | 0,38% | 8 Okt 2026 |
|
CVE-2026-107378
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause qu...
|
8.7 High | — | 0,38% | 8 Okt 2026 |
|
CVE-2026-107377
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or par...
|
7.5 High | — | 0,45% | 8 Okt 2026 |
|
CVE-2026-107376
webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit i...
|
8.2 High | — | 0,45% | 8 Okt 2026 |
|
CVE-2026-107375
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive appli...
|
8.8 High | — | 0,34% | 8 Okt 2026 |