Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-105798
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/up...
|
8.7 High | — | 0,46% | 6 Okt 2026 |
|
CVE-2026-105797
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authoriz...
|
8.8 High | — | 0,56% | 6 Okt 2026 |
|
CVE-2026-105796
Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rath...
|
8.8 High | — | 0,90% | 6 Okt 2026 |
|
CVE-2026-105795
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-control...
|
3.1 Low | — | 1,2% | 6 Okt 2026 |
|
CVE-2026-105794
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSS...
|
9.1 Critical | — | 1,0% | 6 Okt 2026 |
|
CVE-2026-105793
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobil...
|
9.1 Critical | — | 0,87% | 6 Okt 2026 |
|
CVE-2026-105792
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/task_result/{task_name} endpoint calls Session...
|
6.5 Medium | — | 0,69% | 6 Okt 2026 |
|
CVE-2026-105791
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component...
|
7.5 High | — | 0,62% | 6 Okt 2026 |
|
CVE-2026-104069
HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web...
|
7.2 High | — | 0,53% | 6 Okt 2026 |
|
CVE-2025-8352
Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denia...
|
6.9 Medium | — | 0,27% | 6 Okt 2026 |
|
CVE-2026-91140
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generato...
|
9.6 Critical | — | 1,9% | 6 Okt 2026 |
|
CVE-2026-87975
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.forms.models.BaseModelFormSet.save_existing_objects()` used the prese...
|
4.3 Medium | — | 0,24% | 6 Okt 2026 |
|
CVE-2026-87890
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an atta...
|
5.3 Medium | — | 0,29% | 6 Okt 2026 |
|
CVE-2026-85523
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. Samb...
|
8.8 High | — | 0,91% | 6 Okt 2026 |
|
CVE-2026-77178
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) netw...
|
9.1 Critical | — | 0,34% | 6 Okt 2026 |
|
CVE-2026-84429
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.http.parse_header_parameters()` was subject to a potential deni...
|
5.3 Medium | — | 0,38% | 6 Okt 2026 |
|
CVE-2026-82924
Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force.
This issue...
|
5.3 Medium | — | 0,20% | 6 Okt 2026 |
|
CVE-2026-77050
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is subject to
a...
|
5.3 Medium | — | 0,38% | 6 Okt 2026 |
|
CVE-2026-34498
Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection.
This issue affects Illustra Standard -...
|
5.1 Medium | — | 0,69% | 6 Okt 2026 |
|
CVE-2026-12380
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows...
|
6.1 Medium | — | 0,15% | 6 Okt 2026 |
|
CVE-2026-106041
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK replicas th...
|
6.5 Medium | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-106040
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via Evi...
|
8.2 High | — | 0,38% | 6 Okt 2026 |
|
CVE-2026-106039
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete rep...
|
6.5 Medium | — | 0,33% | 6 Okt 2026 |
|
CVE-2026-106038
Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, Re...
|
8.2 High | — | 0,49% | 6 Okt 2026 |
|
CVE-2026-106037
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unaut...
|
9.8 Critical | — | 0,70% | 6 Okt 2026 |
|
CVE-2026-106026
tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticat...
|
3.7 Low | — | 0,37% | 6 Okt 2026 |
|
CVE-2026-105920
A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of t...
|
7.3 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-105842
lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pa...
|
6.4 Medium | — | 0,21% | 6 Okt 2026 |
|
CVE-2026-105841
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying craf...
|
7.5 High | — | 0,95% | 6 Okt 2026 |
|
CVE-2026-105840
lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the c...
|
7.5 High | — | 0,31% | 6 Okt 2026 |
|
CVE-2026-105839
libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. At...
|
7.8 High | — | 0,15% | 6 Okt 2026 |
|
CVE-2026-105838
libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via ov...
|
5.5 Medium | — | 0,13% | 6 Okt 2026 |
|
CVE-2026-105837
libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track cou...
|
7.8 High | — | 0,15% | 6 Okt 2026 |
|
CVE-2026-105790
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices...
|
6.4 Medium | — | 0,53% | 6 Okt 2026 |
|
CVE-2026-105789
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/http_servers...
|
5.4 Medium | — | 0,70% | 6 Okt 2026 |
|
CVE-2026-105788
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/h...
|
8.8 High | — | 1,1% | 6 Okt 2026 |
|
CVE-2025-15591
Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page.
|
5.3 Medium | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-82531
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component templa...
|
8.1 High | — | 0,82% | 6 Okt 2026 |
|
CVE-2026-106016
mozilla firefox
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
|
9.8 Critical | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-105919
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of t...
|
7.3 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-105836
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office emplo...
|
5.4 Medium | — | 0,23% | 6 Okt 2026 |
|
CVE-2026-105835
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authenticati...
|
7.4 High | — | 0,32% | 6 Okt 2026 |
|
CVE-2026-105834
Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources....
|
6.5 Medium | — | 0,36% | 6 Okt 2026 |
|
CVE-2026-56596
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling pr...
|
3.5 Low | — | 0,21% | 6 Okt 2026 |
|
CVE-2026-105918
A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file...
|
7.3 High | — | 0,26% | 6 Okt 2026 |
|
CVE-2026-75820
GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the...
|
1.8 Low | — | 0,13% | 6 Okt 2026 |
|
CVE-2026-75819
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from...
|
1.8 Low | — | 0,12% | 6 Okt 2026 |
|
CVE-2026-75818
GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so...
|
1.8 Low | — | 0,14% | 6 Okt 2026 |
|
CVE-2026-105985
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.
Any authenticated user with basic...
|
8.8 High | — | 0,69% | 6 Okt 2026 |
|
CVE-2026-103831
CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize()...
|
7.5 High | — | 0,17% | 6 Okt 2026 |