Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-106186
google chrome
Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary cod...
|
8.6 High | — | 0,15% | 6 Okt 2026 |
|
CVE-2026-106183
google chrome
Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network tr...
|
5.9 Medium | — | 0,27% | 6 Okt 2026 |
|
CVE-2026-106182
google chrome
UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity:...
|
5.4 Medium | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-106181
google chrome
Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive...
|
5.3 Medium | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-106180
google chrome
Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Ch...
|
3.1 Low | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-106179
google chrome
UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security...
|
5.4 Medium | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-106123
vmware rabbitmq java client
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.loa...
|
5.5 Medium | — | 0,16% | 6 Okt 2026 |
|
CVE-2026-106122
vmware rabbitmq java client
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes...
|
7.5 High | — | 0,48% | 6 Okt 2026 |
|
CVE-2026-106121
vmware rabbitmq java client
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReade...
|
7.5 High | — | 0,50% | 6 Okt 2026 |
|
CVE-2026-106120
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited ar...
|
6.0 Medium | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-106119
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted str...
|
6.0 Medium | — | 0,46% | 6 Okt 2026 |
|
CVE-2026-106118
ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constr...
|
7.5 High | — | 0,60% | 6 Okt 2026 |
|
CVE-2026-105488
Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify a...
|
7.1 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-106033
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specific...
|
5.4 Medium | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-105485
Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a...
|
6.8 Medium | — | 0,40% | 6 Okt 2026 |
|
CVE-2026-104945
TP-Link Tapo
C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ
SOAP handlers. An authenticated ONVIF client can submit an excessive number of...
|
6.8 Medium | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-104944
TP-Link Tapo
C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP
(TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can
cause an...
|
7.1 High | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-104073
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to...
|
7.6 High | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-103778
Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access coul...
|
6.2 Medium | — | 0,16% | 6 Okt 2026 |
|
CVE-2026-103620
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default br...
|
6.0 Medium | — | 0,61% | 6 Okt 2026 |
|
CVE-2026-102322
google chrome
Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium se...
|
9.6 Critical | — | 0,41% | 6 Okt 2026 |
|
CVE-2026-0198
In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execut...
|
4.4 Medium | — | 0,09% | 6 Okt 2026 |
|
CVE-2026-88252
A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open...
|
4.7 Medium | — | 0,14% | 6 Okt 2026 |
|
CVE-2026-66666
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 t...
|
6.9 Medium | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-106117
ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to...
|
7.5 High | — | 0,43% | 6 Okt 2026 |
|
CVE-2026-106116
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When...
|
5.3 Medium | — | 0,37% | 6 Okt 2026 |
|
CVE-2026-106115
ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressS...
|
7.5 High | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-106114
ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions befo...
|
5.3 Medium | — | 0,37% | 6 Okt 2026 |
|
CVE-2026-106113
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualiza...
|
7.5 High | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-106112
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntry...
|
7.5 High | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-106111
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the...
|
5.9 Medium | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-106110
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCc...
|
7.5 High | — | 0,35% | 6 Okt 2026 |
|
CVE-2026-106109
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.dist...
|
4.1 Medium | — | 0,13% | 6 Okt 2026 |
|
CVE-2026-106107
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ss...
|
8.3 High | — | 0,27% | 6 Okt 2026 |
|
CVE-2026-106106
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError()...
|
7.1 High | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-106105
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3....
|
8.4 High | — | 0,07% | 6 Okt 2026 |
|
CVE-2026-106104
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header t...
|
8.7 High | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-106103
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted...
|
7.1 High | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-101207
Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('...
|
8.8 High | — | 1,7% | 6 Okt 2026 |
|
CVE-2025-45871
LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL querie...
|
8.1 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-95153
An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints
|
4.9 Medium | — | 0,36% | 6 Okt 2026 |
|
CVE-2026-95140
kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path...
|
7.5 High | — | 0,59% | 6 Okt 2026 |
|
CVE-2026-106219
jetbrains teamcity
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
|
7.5 High | — | 0,64% | 6 Okt 2026 |
|
CVE-2026-106218
jetbrains teamcity
In JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
|
10.0 Critical | — | 0,28% | 6 Okt 2026 |
|
CVE-2026-106102
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js us...
|
10.0 Critical | — | 0,30% | 6 Okt 2026 |
|
CVE-2026-106101
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted...
|
3.1 Low | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-106100
payloadcms payload
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an auth...
|
7.1 High | — | 0,22% | 6 Okt 2026 |
|
CVE-2026-105957
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/view_product.php. Pe...
|
6.3 Medium | — | 0,20% | 6 Okt 2026 |
|
CVE-2026-105868
payloadcms payload
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations th...
|
7.1 High | — | 0,17% | 6 Okt 2026 |
|
CVE-2026-105867
payloadcms payload
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an auth...
|
6.5 Medium | — | 0,22% | 6 Okt 2026 |