Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-102404
elasticsearch
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can s...
|
6.5 Medium | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-102169
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal ser...
|
6.5 Medium | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-102168
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal ser...
|
6.5 Medium | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-102167
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash t...
|
7.5 High | — | 0,23% | 6 Okt 2026 |
|
CVE-2026-102165
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or...
|
7.5 High | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-102164
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to th...
|
3.1 Low | — | 0,19% | 6 Okt 2026 |
|
CVE-2026-102163
On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a cra...
|
8.8 High | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-102162
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could al...
|
8.8 High | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-102161
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge t...
|
8.8 High | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-102160
An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and...
|
7.2 High | — | 1,4% | 6 Okt 2026 |
|
CVE-2026-102159
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploit...
|
9.8 Critical | — | 0,36% | 6 Okt 2026 |
|
CVE-2026-102158
Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injectio...
|
6.5 Medium | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-102157
An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack condit...
|
5.9 Medium | — | 0,25% | 6 Okt 2026 |
|
CVE-2026-102156
Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditio...
|
6.8 Medium | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-102155
An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbi...
|
8.5 High | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-101158
A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting...
|
8.4 High | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-101157
A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an aut...
|
8.7 High | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-101156
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may...
|
8.4 High | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-101155
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests...
|
9.1 Critical | — | 0,56% | 6 Okt 2026 |
|
CVE-2026-101154
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests...
|
7.2 High | — | 0,56% | 6 Okt 2026 |
|
CVE-2026-101153
On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileg...
|
8.0 High | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-101152
Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the iden...
|
8.0 High | — | 0,38% | 6 Okt 2026 |
|
CVE-2026-101151
Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser...
|
4.3 Medium | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-101029
gitea
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was...
|
4.3 Medium | — | 0,17% | 6 Okt 2026 |
|
CVE-2026-101027
gitea
When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restri...
|
7.7 High | — | 0,16% | 6 Okt 2026 |
|
CVE-2026-101150
Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
|
4.1 Medium | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-101149
Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
|
4.1 Medium | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-9226
Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay o...
|
6.8 Medium | — | 0,21% | 6 Okt 2026 |
|
CVE-2026-96890
github enterprise server
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue reques...
|
8.8 High | — | 0,48% | 6 Okt 2026 |
|
CVE-2026-86362
dell system update
Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit th...
|
8.2 High | — | 0,13% | 6 Okt 2026 |
|
CVE-2026-86361
dell system update
Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local acces...
|
8.2 High | — | 0,14% | 6 Okt 2026 |
|
CVE-2026-86360
dell system update
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticate...
|
9.6 Critical | — | 0,63% | 6 Okt 2026 |
|
CVE-2026-83550
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker...
|
7.1 High | — | 0,21% | 6 Okt 2026 |
|
CVE-2026-82162
dell command|configure
Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability. An unauthenticated attacker with remote access c...
|
9.8 Critical | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-71168
dell system update
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged...
|
7.8 High | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-70414
dell command|configure
Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could poten...
|
5.5 Medium | — | 0,10% | 6 Okt 2026 |
|
CVE-2026-63697
dell system update
Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially...
|
7.2 High | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-56952
In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of pr...
|
6.7 Medium | — | 0,08% | 6 Okt 2026 |
|
CVE-2026-56936
In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege wi...
|
6.8 Medium | — | 0,10% | 6 Okt 2026 |
|
CVE-2026-56906
In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privi...
|
7.0 High | — | 0,05% | 6 Okt 2026 |
|
CVE-2026-55330
In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with...
|
9.8 Critical | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-55307
In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure wi...
|
4.4 Medium | — | 0,07% | 6 Okt 2026 |
|
CVE-2026-106511
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability wh...
|
9.8 Critical | — | 0,38% | 6 Okt 2026 |
|
CVE-2026-106513
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—t...
|
6.9 Medium | — | 0,64% | 6 Okt 2026 |
|
CVE-2026-106512
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into...
|
8.4 High | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-106443
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS...
|
8.8 High | — | 0,69% | 6 Okt 2026 |
|
CVE-2026-106442
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-685...
|
7.8 High | — | 0,16% | 6 Okt 2026 |
|
CVE-2026-106441
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig...
|
7.8 High | — | 0,17% | 6 Okt 2026 |
|
CVE-2026-106425
google chrome
Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engine...
|
4.2 Medium | — | 0,16% | 6 Okt 2026 |
|
CVE-2026-106422
google chrome
Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security s...
|
4.3 Medium | — | 0,20% | 6 Okt 2026 |