Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-106579
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick...
|
6.2 Medium | — | 0,14% | 7 Okt 2026 |
|
CVE-2026-106578
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memor...
|
5.9 Medium | — | 0,40% | 7 Okt 2026 |
|
CVE-2026-106577
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject c...
|
5.3 Medium | — | 0,34% | 7 Okt 2026 |
|
CVE-2026-106576
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while t...
|
5.3 Medium | — | 0,37% | 7 Okt 2026 |
|
CVE-2026-106575
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer...
|
5.3 Medium | — | 0,37% | 7 Okt 2026 |
|
CVE-2026-106574
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server...
|
5.3 Medium | — | 0,20% | 7 Okt 2026 |
|
CVE-2026-106573
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder a...
|
5.3 Medium | — | 0,38% | 7 Okt 2026 |
|
CVE-2026-106572
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CAL...
|
5.3 Medium | — | 0,38% | 7 Okt 2026 |
|
CVE-2026-106571
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixe...
|
5.1 Medium | — | 0,13% | 7 Okt 2026 |
|
CVE-2026-106570
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedl...
|
4.3 Medium | — | 0,19% | 7 Okt 2026 |
|
CVE-2026-106569
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decode...
|
5.3 Medium | — | 0,38% | 7 Okt 2026 |
|
CVE-2026-106568
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image...
|
5.3 Medium | — | 0,38% | 7 Okt 2026 |
|
CVE-2026-106567
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-...
|
5.9 Medium | — | 0,40% | 7 Okt 2026 |
|
CVE-2026-106566
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED...
|
4.0 Medium | — | 0,12% | 7 Okt 2026 |
|
CVE-2026-106565
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading...
|
5.9 Medium | — | 0,40% | 7 Okt 2026 |
|
CVE-2026-106564
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write b...
|
5.3 Medium | — | 0,37% | 7 Okt 2026 |
|
CVE-2026-77214
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len...
|
8.2 High | — | 0,55% | 7 Okt 2026 |
|
CVE-2026-62179
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependenc...
|
6.5 Medium | — | 0,18% | 7 Okt 2026 |
|
CVE-2026-46570
tuxera ntfs-3g
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root...
|
8.1 High | — | 0,15% | 7 Okt 2026 |
|
CVE-2026-107202
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an...
|
9.1 Critical | — | 0,78% | 7 Okt 2026 |
|
CVE-2026-107174
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker...
|
6.4 Medium | — | 0,29% | 7 Okt 2026 |
|
CVE-2026-107169
A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing...
|
6.2 Medium | — | 0,11% | 7 Okt 2026 |
|
CVE-2026-107167
A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under speci...
|
6.2 Medium | — | 0,12% | 7 Okt 2026 |
|
CVE-2026-107125
A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes h...
|
6.3 Medium | — | 0,32% | 7 Okt 2026 |
|
CVE-2026-106563
Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation...
|
5.3 Medium | — | 0,22% | 7 Okt 2026 |
|
CVE-2026-106562
Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-ela...
|
4.3 Medium | — | 0,20% | 7 Okt 2026 |
|
CVE-2026-106561
Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disc...
|
5.0 Medium | — | 0,20% | 7 Okt 2026 |
|
CVE-2026-106560
Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected...
|
7.1 High | — | 0,33% | 7 Okt 2026 |
|
CVE-2026-106559
Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected...
|
6.3 Medium | — | 0,32% | 7 Okt 2026 |
|
CVE-2026-106558
linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage
Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mappin...
|
8.8 High | — | 0,47% | 7 Okt 2026 |
|
CVE-2026-106556
linuxfoundation backstage, linuxfoundation backstage plugin-techdocs-node
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdoc...
|
7.7 High | — | 0,26% | 7 Okt 2026 |
|
CVE-2026-106510
linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via craft...
|
7.7 High | — | 0,45% | 7 Okt 2026 |
|
CVE-2026-106064
A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow when computing the pixe...
|
6.3 Medium | — | 0,11% | 7 Okt 2026 |
|
CVE-2026-104074
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Alloc...
|
5.3 Medium | — | 0,31% | 7 Okt 2026 |
|
CVE-2025-70522
The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the a...
|
8.8 High | — | 0,16% | 7 Okt 2026 |
|
CVE-2025-70521
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handlin...
|
9.8 Critical | — | 0,43% | 7 Okt 2026 |
|
CVE-2025-70520
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions gr...
|
9.8 Critical | — | 0,19% | 7 Okt 2026 |
|
CVE-2025-70519
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for...
|
6.1 Medium | — | 0,23% | 7 Okt 2026 |
|
CVE-2025-70518
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handlin...
|
10.0 Critical | — | 0,56% | 7 Okt 2026 |
|
CVE-2025-70517
The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the a...
|
8.8 High | — | 0,16% | 7 Okt 2026 |
|
CVE-2025-70516
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions gr...
|
9.1 Critical | — | 0,33% | 7 Okt 2026 |
|
CVE-2026-88514
An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.
|
5.5 Medium | — | 0,10% | 7 Okt 2026 |
|
CVE-2026-46572
tuxera ntfs-3g
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs...
|
7.4 High | — | 0,15% | 7 Okt 2026 |
|
CVE-2026-46569
tuxera ntfs-3g
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root n...
|
7.7 High | — | 0,16% | 7 Okt 2026 |
|
CVE-2026-46571
tuxera ntfs-3g
In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information...
|
5.5 Medium | — | 0,13% | 7 Okt 2026 |
|
CVE-2026-46438
wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `S...
|
6.5 Medium | — | 0,23% | 7 Okt 2026 |
|
CVE-2026-46437
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style A...
|
4.8 Medium | — | 0,19% | 7 Okt 2026 |
|
CVE-2026-46434
wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, i...
|
7.1 High | — | 0,22% | 7 Okt 2026 |
|
CVE-2026-45161
wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without...
|
5.4 Medium | — | 0,09% | 7 Okt 2026 |
|
CVE-2026-42616
tuxera ntfs-3g
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicio...
|
7.8 High | — | 0,16% | 7 Okt 2026 |