Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-19083
Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionalit...
|
8.8 High | — | 0,25% | 8 Okt 2026 |
|
CVE-2026-107587
Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail...
|
5.9 Medium | — | 0,17% | 8 Okt 2026 |
|
CVE-2026-107584
Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TL...
|
7.4 High | — | 0,15% | 8 Okt 2026 |
|
CVE-2026-107583
Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated atta...
|
6.5 Medium | — | 0,26% | 8 Okt 2026 |
|
CVE-2026-107582
Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a re...
|
6.5 Medium | — | 0,26% | 8 Okt 2026 |
|
CVE-2026-107581
Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of e...
|
6.5 Medium | — | 0,25% | 8 Okt 2026 |
|
CVE-2026-107580
Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker...
|
6.5 Medium | — | 0,26% | 8 Okt 2026 |
|
CVE-2026-107579
Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to sto...
|
7.5 High | — | 0,35% | 8 Okt 2026 |
|
CVE-2026-107578
Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6....
|
6.7 Medium | — | 0,07% | 8 Okt 2026 |
|
CVE-2026-107577
Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a rem...
|
7.5 High | — | 0,43% | 8 Okt 2026 |
|
CVE-2026-107576
Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated...
|
7.5 High | — | 0,43% | 8 Okt 2026 |
|
CVE-2026-107575
Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-...
|
5.3 Medium | — | 0,39% | 8 Okt 2026 |
|
CVE-2026-107574
Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Rea...
|
7.5 High | — | 0,43% | 8 Okt 2026 |
|
CVE-2026-107573
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's dat...
|
7.8 High | — | 0,10% | 8 Okt 2026 |
|
CVE-2026-107572
Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail servic...
|
6.5 Medium | — | 0,31% | 8 Okt 2026 |
|
CVE-2026-107570
heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.
|
2.5 Low | — | 0,13% | 8 Okt 2026 |
|
CVE-2026-107275
@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's...
|
6.8 Medium | — | 0,31% | 8 Okt 2026 |
|
CVE-2026-93509
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a...
|
6.5 Medium | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-105190
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticat...
|
5.3 Medium | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-104704
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-...
|
7.4 High | — | 0,15% | 8 Okt 2026 |
|
CVE-2026-104671
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated vis...
|
5.3 Medium | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-104660
Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read...
|
7.8 High | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-104659
Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow...
|
7.5 High | — | 0,14% | 8 Okt 2026 |
|
CVE-2026-104658
The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmails...
|
7.8 High | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-103649
Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop...
|
7.5 High | — | 0,27% | 8 Okt 2026 |
|
CVE-2026-103647
Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script i...
|
8.0 High | — | 0,25% | 8 Okt 2026 |
|
CVE-2026-103517
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when...
|
5.3 Medium | — | 0,11% | 8 Okt 2026 |
|
CVE-2026-103011
Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through...
|
6.5 Medium | — | 0,21% | 8 Okt 2026 |
|
CVE-2026-103010
Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Window...
|
7.8 High | — | 0,16% | 8 Okt 2026 |
|
CVE-2026-107510
An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.
|
9.1 Critical | — | 0,29% | 8 Okt 2026 |
|
CVE-2026-107503
In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the Open...
|
7.1 High | — | 0,18% | 8 Okt 2026 |
|
CVE-2026-71896
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list...
|
6.5 Medium | — | 0,26% | 8 Okt 2026 |
|
CVE-2026-71895
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-manage...
|
7.1 High | — | 0,22% | 8 Okt 2026 |
|
CVE-2026-71183
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through th...
|
7.1 High | — | 0,22% | 8 Okt 2026 |
|
CVE-2026-89191
Unsanitised input in
the "template name" field of SQLView KRIS's Workflow Template feature
is rendered in "onclick" attributes on the main dashboard without
proper server...
|
6.8 Medium | — | 0,24% | 8 Okt 2026 |
|
CVE-2026-66087
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through...
|
8.1 High | — | 0,28% | 8 Okt 2026 |
|
CVE-2026-66084
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access throu...
|
8.1 High | — | 0,33% | 8 Okt 2026 |
|
CVE-2026-66082
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions...
|
6.5 Medium | — | 0,30% | 8 Okt 2026 |
|
CVE-2026-4894
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be acce...
|
6.9 Medium | — | 0,38% | 8 Okt 2026 |
|
CVE-2026-12260
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The...
|
10.0 Critical | — | 0,23% | 8 Okt 2026 |
|
CVE-2026-105110
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via...
|
9.8 Critical | — | 2,8% | 8 Okt 2026 |
|
CVE-2026-93699
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.
|
8.5 High | — | 0,13% | 8 Okt 2026 |
|
CVE-2026-107466
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to p...
|
6.1 Medium | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-87428
broadcom brocade active support connectivity gateway
In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credent...
|
7.8 High | — | 0,10% | 8 Okt 2026 |
|
CVE-2026-87426
broadcom brocade active support connectivity gateway
An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details an...
|
4.3 Medium | — | 0,15% | 8 Okt 2026 |
|
CVE-2026-87425
broadcom brocade active support connectivity gateway
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) ce...
|
6.8 Medium | — | 0,10% | 8 Okt 2026 |
|
CVE-2026-87424
broadcom brocade active support connectivity gateway
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due...
|
8.8 High | — | 0,19% | 8 Okt 2026 |
|
CVE-2026-85490
broadcom brocade active support connectivity gateway
When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences co...
|
8.8 High | — | 0,31% | 8 Okt 2026 |
|
CVE-2026-85489
broadcom brocade active support connectivity gateway
An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform pr...
|
8.8 High | — | 0,22% | 8 Okt 2026 |
|
CVE-2026-85488
broadcom brocade active support connectivity gateway
Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to t...
|
7.8 High | — | 0,09% | 8 Okt 2026 |