Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-14991
ibm datapower gateway
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, cau...
|
9.8 Critical | — | 0,41% | 8 Okt 2026 |
|
CVE-2026-14990
IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript co...
|
9.3 Critical | — | 0,31% | 8 Okt 2026 |
|
CVE-2026-107615
An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with S...
|
7.8 High | — | 0,14% | 8 Okt 2026 |
|
CVE-2026-107614
An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server...
|
6.1 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-107613
A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, c...
|
5.9 Medium | — | 0,31% | 8 Okt 2026 |
|
CVE-2026-107612
Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communicati...
|
7.8 High | — | 0,10% | 8 Okt 2026 |
|
CVE-2026-107611
An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap me...
|
7.1 High | — | 0,24% | 8 Okt 2026 |
|
CVE-2026-104634
Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to reach the h...
|
2.3 Low | — | 0,34% | 8 Okt 2026 |
|
CVE-2026-103663
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remo...
|
9.4 Critical | — | 0,71% | 8 Okt 2026 |
|
CVE-2026-66479
Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.
|
7.1 High | — | 0,09% | 8 Okt 2026 |
|
CVE-2026-62142
Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.
|
8.8 High | — | 0,13% | 8 Okt 2026 |
|
CVE-2026-62128
Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creat...
|
5.3 Medium | — | 0,21% | 8 Okt 2026 |
|
CVE-2026-62127
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored X...
|
6.5 Medium | — | 0,16% | 8 Okt 2026 |
|
CVE-2026-44038
A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to r...
|
4.4 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-44037
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFF...
|
5.5 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-44036
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc)...
|
5.5 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-44035
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaus...
|
5.5 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-44034
A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjac...
|
4.4 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-44033
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker...
|
5.5 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-44031
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a...
|
7.5 High | — | 0,39% | 8 Okt 2026 |
|
CVE-2026-19218
Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recover...
|
9.1 Critical | — | 0,23% | 8 Okt 2026 |
|
CVE-2026-16340
ibm datapower gateway
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execut...
|
9.8 Critical | — | 0,49% | 8 Okt 2026 |
|
CVE-2026-16182
ibm datapower gateway
IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacke...
|
5.9 Medium | — | 0,27% | 8 Okt 2026 |
|
CVE-2026-16181
ibm datapower gateway
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass...
|
7.4 High | — | 0,31% | 8 Okt 2026 |
|
CVE-2026-16179
ibm datapower gateway
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap...
|
7.5 High | — | 0,32% | 8 Okt 2026 |
|
CVE-2026-16178
ibm datapower gateway
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...
|
7.5 High | — | 0,39% | 8 Okt 2026 |
|
CVE-2026-16177
ibm datapower gateway
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated atta...
|
5.3 Medium | — | 0,31% | 8 Okt 2026 |
|
CVE-2026-16176
ibm datapower gateway
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...
|
7.5 High | — | 0,39% | 8 Okt 2026 |
|
CVE-2026-16170
ibm datapower gateway
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause...
|
7.5 High | — | 0,39% | 8 Okt 2026 |
|
CVE-2026-16169
ibm datapower gateway
IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
|
7.5 High | — | 0,39% | 8 Okt 2026 |
|
CVE-2026-14521
ibm datapower gateway
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request fo...
|
4.9 Medium | — | 0,15% | 8 Okt 2026 |
|
CVE-2026-106611
Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3...
|
7.1 High | — | 0,12% | 8 Okt 2026 |
|
CVE-2026-106603
Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels....
|
6.5 Medium | — | 0,21% | 8 Okt 2026 |
|
CVE-2026-106600
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveW...
|
5.3 Medium | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-106596
Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Lev...
|
5.3 Medium | — | 0,25% | 8 Okt 2026 |
|
CVE-2026-105893
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This is...
|
5.3 Medium | — | 0,26% | 8 Okt 2026 |
|
CVE-2026-105891
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This iss...
|
4.3 Medium | — | 0,20% | 8 Okt 2026 |
|
CVE-2026-105890
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-bl...
|
6.5 Medium | — | 0,16% | 8 Okt 2026 |
|
CVE-2026-105888
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This iss...
|
5.4 Medium | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-105887
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gallery robo-gallery allows Stored XSS.This issue affe...
|
6.5 Medium | — | 0,16% | 8 Okt 2026 |
|
CVE-2026-105886
Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff...
|
6.5 Medium | — | 0,25% | 8 Okt 2026 |
|
CVE-2026-105878
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Secu...
|
5.3 Medium | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-105079
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-s...
|
6.5 Medium | — | 0,16% | 8 Okt 2026 |
|
CVE-2026-105078
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator wp-store-locator allows Stored XSS...
|
6.5 Medium | — | 0,16% | 8 Okt 2026 |
|
CVE-2026-105076
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue af...
|
7.6 High | — | 0,23% | 8 Okt 2026 |
|
CVE-2026-103072
Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec...
|
4.3 Medium | — | 0,20% | 8 Okt 2026 |
|
CVE-2026-103070
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser all...
|
6.5 Medium | — | 0,16% | 8 Okt 2026 |
|
CVE-2026-102784
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when...
|
8.7 High | — | 0,17% | 8 Okt 2026 |
|
CVE-2026-102783
Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper ....
|
6.3 Medium | — | 0,47% | 8 Okt 2026 |
|
CVE-2026-92555
Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows P...
|
9.8 Critical | — | 0,37% | 8 Okt 2026 |