Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-73278
gitea
Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenti...
|
9.8 Critical | — | 0,47% | 6 Okt 2026 |
|
CVE-2026-76746
An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory cont...
|
9.3 Critical | — | 0,20% | 6 Okt 2026 |
|
CVE-2026-76745
Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute ar...
|
9.6 Critical | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-76744
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code...
|
9.8 Critical | — | 0,51% | 6 Okt 2026 |
|
CVE-2026-76743
A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentic...
|
9.8 Critical | — | 0,55% | 6 Okt 2026 |
|
CVE-2026-76742
Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unaut...
|
9.8 Critical | — | 0,59% | 6 Okt 2026 |
|
CVE-2026-76741
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an authenticated remote attacker to cause a denial-of-servic...
|
6.5 Medium | — | 0,39% | 6 Okt 2026 |
|
CVE-2026-76061
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Contai...
|
5.5 Medium | — | 0,23% | 6 Okt 2026 |
|
CVE-2026-70357
gitea
Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname...
|
7.5 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-106454
Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the I...
|
4.3 Medium | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-106453
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header...
|
5.3 Medium | — | 0,37% | 6 Okt 2026 |
|
CVE-2026-106452
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Blo...
|
5.3 Medium | — | 0,37% | 6 Okt 2026 |
|
CVE-2026-106451
yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck...
|
7.3 High | — | 0,08% | 6 Okt 2026 |
|
CVE-2026-106450
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maxi...
|
5.3 Medium | — | 0,37% | 6 Okt 2026 |
|
CVE-2026-106449
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-fo...
|
3.7 Low | — | 0,34% | 6 Okt 2026 |
|
CVE-2026-106448
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and...
|
8.9 High | — | 0,40% | 6 Okt 2026 |
|
CVE-2026-106447
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and ta...
|
8.7 High | — | 0,37% | 6 Okt 2026 |
|
CVE-2026-106446
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed...
|
9.8 Critical | — | 0,64% | 6 Okt 2026 |
|
CVE-2026-106445
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor b...
|
9.2 Critical | — | 0,41% | 6 Okt 2026 |
|
CVE-2026-106444
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/comp...
|
4.7 Medium | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-106063
A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer u...
|
6.3 Medium | — | 0,12% | 6 Okt 2026 |
|
CVE-2026-105244
apache log4net
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
Every character outside visible ASCII and space was removed from the...
|
5.3 Medium | — | 0,82% | 6 Okt 2026 |
|
CVE-2026-105243
apache log4net
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.
Long messages were truncated to a fixed size that exceeds what the Windows Event Log accept...
|
5.3 Medium | — | 0,81% | 6 Okt 2026 |
|
CVE-2026-105242
apache log4net
Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.
Reading request parameters triggers ASP.NET request...
|
5.3 Medium | — | 0,82% | 6 Okt 2026 |
|
CVE-2026-104636
gitea
Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HT...
|
7.5 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-104632
gitea
Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to b...
|
8.8 High | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-104626
gitea
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a la...
|
8.8 High | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-105241
apache log4net
Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.
Content that the mail file writer cannot encode, such as an unpaired...
|
5.3 Medium | — | 0,82% | 6 Okt 2026 |
|
CVE-2026-105240
apache log4net
Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.
A NUL character in logged content ended the debug...
|
5.3 Medium | — | 0,81% | 6 Okt 2026 |
|
CVE-2026-105239
apache log4net
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.
A NUL character in logged content ended the Windows Event...
|
5.3 Medium | — | 0,82% | 6 Okt 2026 |
|
CVE-2026-105111
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.
This only happens when you're using Class2HT...
|
4.7 Medium | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-103667
gitea
Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or re...
|
5.4 Medium | — | 0,17% | 6 Okt 2026 |
|
CVE-2026-103504
Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not ap...
|
8.1 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-103670
gitea
When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval....
|
7.5 High | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-103059
gitea
When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, whic...
|
9.1 Critical | — | 0,27% | 6 Okt 2026 |
|
CVE-2026-104048
fedoraproject sssd, redhat openshift container platform +1 lainnya
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comp...
|
8.1 High | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-104047
fedoraproject sssd, redhat openshift container platform +1 lainnya
A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A lo...
|
5.3 Medium | — | 0,11% | 6 Okt 2026 |
|
CVE-2026-103009
elasticsearch
Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that r...
|
7.1 High | — | 0,23% | 6 Okt 2026 |
|
CVE-2026-103008
elasticsearch
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply n...
|
6.5 Medium | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-103007
elasticsearch
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during auth...
|
7.2 High | — | 0,34% | 6 Okt 2026 |
|
CVE-2026-103006
elasticsearch
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the...
|
6.5 Medium | — | 0,41% | 6 Okt 2026 |
|
CVE-2026-103005
elasticsearch
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with conn...
|
6.5 Medium | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-102413
Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component process...
|
6.2 Medium | — | 0,13% | 6 Okt 2026 |
|
CVE-2026-102412
elastic kibana
Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authen...
|
6.5 Medium | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-102411
elasticsearch
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces...
|
6.5 Medium | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-102410
elastic kibana
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surfa...
|
4.3 Medium | — | 0,21% | 6 Okt 2026 |
|
CVE-2026-102409
elasticsearch
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service,...
|
6.5 Medium | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-102408
elasticsearch
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK...
|
4.3 Medium | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-102407
elasticsearch
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1...
|
5.4 Medium | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-102406
elastic kibana
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team shar...
|
8.8 High | — | 0,34% | 6 Okt 2026 |