Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-105741
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) c...
|
7.1 High | — | 0,21% | 5 Okt 2026 |
|
CVE-2026-105740
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on...
|
9.9 Critical | — | 0,59% | 5 Okt 2026 |
|
CVE-2026-105699
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a projec...
|
7.1 High | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-105698
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api...
|
5.4 Medium | — | 0,18% | 5 Okt 2026 |
|
CVE-2026-105697
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put...
|
9.9 Critical | — | 0,47% | 5 Okt 2026 |
|
CVE-2026-105447
A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to gl...
|
5.5 Medium | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-105444
A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the compo...
|
6.3 Medium | — | 0,24% | 5 Okt 2026 |
|
CVE-2026-105438
A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of t...
|
4.3 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-102262
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious mod...
|
7.3 High | — | 0,21% | 5 Okt 2026 |
|
CVE-2026-101893
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job...
|
4.4 Medium | — | 0,15% | 5 Okt 2026 |
|
CVE-2026-95264
Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. A...
|
6.5 Medium | — | 0,53% | 5 Okt 2026 |
|
CVE-2026-95265
Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-...
|
7.5 High | — | 0,24% | 5 Okt 2026 |
|
CVE-2026-95263
Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built...
|
7.2 High | — | 0,27% | 5 Okt 2026 |
|
CVE-2026-97257
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner:...
|
8.8 High | — | 0,36% | 5 Okt 2026 |
|
CVE-2026-94201
Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.T...
|
8.2 High | — | 0,30% | 5 Okt 2026 |
|
CVE-2026-93617
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: fro...
|
7.2 High | — | 0,30% | 5 Okt 2026 |
|
CVE-2026-78862
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (PCB)
|
6.8 Medium | — | 0,18% | 5 Okt 2026 |
|
CVE-2026-78861
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key
|
7.7 High | — | 0,14% | 5 Okt 2026 |
|
CVE-2026-78860
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext
|
7.8 High | — | 0,08% | 5 Okt 2026 |
|
CVE-2026-71299
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized...
|
6.5 Medium | — | 0,31% | 5 Okt 2026 |
|
CVE-2026-71298
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, whi...
|
6.4 Medium | — | 0,30% | 5 Okt 2026 |
|
CVE-2026-71297
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables t...
|
5.4 Medium | — | 0,15% | 5 Okt 2026 |
|
CVE-2026-105767
Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80ca...
|
3.3 Low | — | 0,19% | 5 Okt 2026 |
|
CVE-2026-105766
Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066...
|
3.1 Low | — | 0,11% | 5 Okt 2026 |
|
CVE-2026-105696
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not v...
|
6.5 Medium | — | 0,28% | 5 Okt 2026 |
|
CVE-2026-105695
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk corre...
|
5.9 Medium | — | 0,30% | 5 Okt 2026 |
|
CVE-2026-105694
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler...
|
5.4 Medium | — | 0,18% | 5 Okt 2026 |
|
CVE-2026-105693
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when...
|
5.3 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-105692
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the...
|
5.4 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-105691
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolorma...
|
9.9 Critical | — | 0,37% | 5 Okt 2026 |
|
CVE-2026-105690
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side se...
|
5.9 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-105689
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64...
|
6.0 Medium | — | 0,27% | 5 Okt 2026 |
|
CVE-2026-105688
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator...
|
6.7 Medium | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-105687
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselv...
|
4.9 Medium | — | 0,29% | 5 Okt 2026 |
|
CVE-2026-105686
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an al...
|
5.3 Medium | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-105684
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-pe...
|
4.3 Medium | — | 0,19% | 5 Okt 2026 |
|
CVE-2026-105683
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended...
|
3.8 Low | — | 0,31% | 5 Okt 2026 |
|
CVE-2026-105682
Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the...
|
2.7 Low | — | 0,24% | 5 Okt 2026 |
|
CVE-2026-105681
Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. Th...
|
6.5 Medium | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-105680
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fi...
|
6.5 Medium | — | 0,27% | 5 Okt 2026 |
|
CVE-2026-105679
Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing...
|
7.3 High | — | 0,24% | 5 Okt 2026 |
|
CVE-2026-105678
Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and C...
|
4.3 Medium | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-105677
Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator...
|
7.2 High | — | 0,52% | 5 Okt 2026 |
|
CVE-2026-105676
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator...
|
4.9 Medium | — | 0,40% | 5 Okt 2026 |
|
CVE-2026-105675
Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pendin...
|
7.5 High | — | 0,39% | 5 Okt 2026 |
|
CVE-2026-105652
Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passw...
|
3.1 Low | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-105651
Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website...
|
7.3 High | — | 0,30% | 5 Okt 2026 |
|
CVE-2026-105650
Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored...
|
8.1 High | — | 0,33% | 5 Okt 2026 |
|
CVE-2026-105649
Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without san...
|
7.3 High | — | 0,30% | 5 Okt 2026 |
|
CVE-2026-105648
Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthentica...
|
4.0 Medium | — | 0,30% | 5 Okt 2026 |