Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-103870
A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that t...
|
5.0 Medium | — | 0,23% | 7 Okt 2026 |
|
CVE-2026-103869
A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download...
|
6.5 Medium | — | 0,23% | 7 Okt 2026 |
|
CVE-2026-103868
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same...
|
6.5 Medium | — | 0,23% | 7 Okt 2026 |
|
CVE-2026-102173
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all version...
|
7.2 High | — | 0,37% | 7 Okt 2026 |
|
CVE-2026-19572
A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow...
|
9.3 Critical | — | 0,37% | 7 Okt 2026 |
|
CVE-2026-84897
wolfssh
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_RE...
|
5.3 Medium | — | 0,30% | 7 Okt 2026 |
|
CVE-2026-83742
wolfssh
Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to...
|
8.8 High | — | 0,39% | 7 Okt 2026 |
|
CVE-2026-83540
wolfssh
When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released be...
|
8.8 High | — | 0,36% | 7 Okt 2026 |
|
CVE-2026-81535
wolfssh
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-t...
|
9.1 Critical | — | 0,27% | 7 Okt 2026 |
|
CVE-2026-16516
wolfssh
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/in...
|
7.4 High | — | 0,12% | 7 Okt 2026 |
|
CVE-2026-14911
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify route...
|
9.3 Critical | — | 0,32% | 7 Okt 2026 |
|
CVE-2026-106061
A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height siz...
|
5.5 Medium | — | 0,11% | 7 Okt 2026 |
|
CVE-2026-19396
A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to ...
|
7.7 High | — | 0,13% | 7 Okt 2026 |
|
CVE-2026-19386
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceed...
|
9.3 Critical | — | 0,19% | 7 Okt 2026 |
|
CVE-2026-16528
Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, pote...
|
8.4 High | — | 0,21% | 7 Okt 2026 |
|
CVE-2026-106471
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of...
|
8.1 High | — | 0,28% | 7 Okt 2026 |
|
CVE-2026-105324
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a...
|
9.2 Critical | — | 0,65% | 7 Okt 2026 |
|
CVE-2026-102478
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege...
|
8.7 High | — | 0,30% | 7 Okt 2026 |
|
CVE-2026-97680
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control...
|
8.3 High | — | 0,27% | 7 Okt 2026 |
|
CVE-2026-97679
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an...
|
8.8 High | — | 0,45% | 7 Okt 2026 |
|
CVE-2026-97678
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
|
8.8 High | — | 0,42% | 7 Okt 2026 |
|
CVE-2026-97676
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in cod...
|
8.8 High | — | 0,55% | 7 Okt 2026 |
|
CVE-2026-97674
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used...
|
8.1 High | — | 0,30% | 7 Okt 2026 |
|
CVE-2026-97673
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
|
8.8 High | — | 0,45% | 7 Okt 2026 |
|
CVE-2026-97671
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
|
6.5 Medium | — | 0,46% | 7 Okt 2026 |
|
CVE-2026-97655
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.
|
8.8 High | — | 0,55% | 7 Okt 2026 |
|
CVE-2026-93679
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file ex...
|
4.3 Medium | — | 0,48% | 7 Okt 2026 |
|
CVE-2026-93678
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
|
7.6 High | — | 0,41% | 7 Okt 2026 |
|
CVE-2026-93677
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthori...
|
6.5 Medium | — | 0,47% | 7 Okt 2026 |
|
CVE-2026-93675
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.
|
9.8 Critical | — | 0,75% | 7 Okt 2026 |
|
CVE-2026-93674
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
|
9.8 Critical | — | 2,7% | 7 Okt 2026 |
|
CVE-2026-93449
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
|
8.8 High | — | 0,68% | 7 Okt 2026 |
|
CVE-2026-93448
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted...
|
6.5 Medium | — | 0,66% | 7 Okt 2026 |
|
CVE-2026-93447
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When t...
|
7.5 High | — | 0,44% | 7 Okt 2026 |
|
CVE-2026-93445
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
|
8.8 High | — | 0,73% | 7 Okt 2026 |
|
CVE-2026-93443
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in cod...
|
8.8 High | — | 0,68% | 7 Okt 2026 |
|
CVE-2026-88962
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
|
8.8 High | — | 0,81% | 7 Okt 2026 |
|
CVE-2026-104334
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
|
9.8 Critical | — | 0,62% | 7 Okt 2026 |
|
CVE-2026-103360
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted...
|
6.5 Medium | — | 0,48% | 7 Okt 2026 |
|
CVE-2026-101331
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
|
6.5 Medium | — | 0,26% | 7 Okt 2026 |
|
CVE-2026-101329
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.
|
6.5 Medium | — | 0,26% | 7 Okt 2026 |
|
CVE-2026-80048
A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length he...
|
5.5 Medium | — | 0,13% | 7 Okt 2026 |
|
CVE-2026-106583
openbsd openssh
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
|
7.8 High | — | 0,15% | 7 Okt 2026 |
|
CVE-2026-104335
langflow
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.
|
8.8 High | — | 0,57% | 7 Okt 2026 |
|
CVE-2026-97626
Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's act...
|
4.3 Medium | — | 0,20% | 6 Okt 2026 |
|
CVE-2026-97208
gitea
The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISAB...
|
4.9 Medium | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-86684
gitea
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCA...
|
7.1 High | — | 0,11% | 6 Okt 2026 |
|
CVE-2026-96594
gitea
The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without...
|
6.1 Medium | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-89182
gitea
With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an em...
|
5.4 Medium | — | 0,17% | 6 Okt 2026 |
|
CVE-2026-65142
NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to co...
|
7.8 High | — | 0,21% | 6 Okt 2026 |