Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-88391
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed...
|
9.8 Critical | — | 0,36% | 5 Okt 2026 |
|
CVE-2026-79820
A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.
|
9.0 Critical | — | 0,27% | 5 Okt 2026 |
|
CVE-2026-105421
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Se...
|
5.3 Medium | — | 0,18% | 5 Okt 2026 |
|
CVE-2026-92931
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make...
|
8.8 High | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-77804
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the installation of...
|
6.6 Medium | — | 0,06% | 5 Okt 2026 |
|
CVE-2026-77803
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding co...
|
3.6 Low | — | 0,09% | 5 Okt 2026 |
|
CVE-2026-77802
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requ...
|
6.3 Medium | — | 0,09% | 5 Okt 2026 |
|
CVE-2026-77805
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the applicati...
|
7.9 High | — | 0,06% | 5 Okt 2026 |
|
CVE-2026-105315
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component...
|
4.7 Medium | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-63277
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to...
|
8.5 High | — | 0,15% | 5 Okt 2026 |
|
CVE-2026-63270
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening...
|
6.7 Medium | — | 0,12% | 5 Okt 2026 |
|
CVE-2026-63269
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer...
|
6.7 Medium | — | 0,11% | 5 Okt 2026 |
|
CVE-2026-63268
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files a...
|
6.7 Medium | — | 0,12% | 5 Okt 2026 |
|
CVE-2026-63267
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so openin...
|
6.7 Medium | — | 0,11% | 5 Okt 2026 |
|
CVE-2026-63266
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird d...
|
6.8 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-39783
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.
|
4.3 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-105396
Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Ori...
|
5.4 Medium | — | 0,10% | 5 Okt 2026 |
|
CVE-2026-105307
A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a...
|
7.3 High | — | 0,38% | 5 Okt 2026 |
|
CVE-2026-105073
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensiti...
|
5.3 Medium | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-103684
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af...
|
5.3 Medium | — | 0,18% | 5 Okt 2026 |
|
CVE-2026-94669
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Leve...
|
5.3 Medium | — | 0,18% | 5 Okt 2026 |
|
CVE-2026-59788
The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browse...
|
5.7 Medium | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-59787
The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP tra...
|
5.3 Medium | — | 0,23% | 5 Okt 2026 |
|
CVE-2026-59786
Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Za...
|
6.9 Medium | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-59785
Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and s...
|
5.1 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-59783
The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability. This only...
|
2.3 Low | — | 0,23% | 5 Okt 2026 |
|
CVE-2026-59782
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in le...
|
6.9 Medium | — | 0,24% | 5 Okt 2026 |
|
CVE-2026-39763
Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security...
|
4.3 Medium | — | 0,15% | 5 Okt 2026 |
|
CVE-2026-105291
A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/G...
|
4.3 Medium | — | 0,44% | 5 Okt 2026 |
|
CVE-2026-105290
A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the c...
|
7.3 High | — | 0,47% | 5 Okt 2026 |
|
CVE-2026-105289
A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineF...
|
3.5 Low | — | 0,33% | 5 Okt 2026 |
|
CVE-2026-19395
In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes th...
|
6.6 Medium | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-105288
A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/fun...
|
4.3 Medium | — | 0,44% | 5 Okt 2026 |
|
CVE-2026-105287
A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the comp...
|
6.3 Medium | — | 0,32% | 5 Okt 2026 |
|
CVE-2026-105286
A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the component File Uploa...
|
6.3 Medium | — | 0,35% | 5 Okt 2026 |
|
CVE-2026-105285
A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS R...
|
10.0 Critical | — | 0,64% | 5 Okt 2026 |
|
CVE-2026-97071
Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17.
|
5.3 Medium | — | 0,19% | 5 Okt 2026 |
|
CVE-2026-39721
Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a...
|
5.4 Medium | — | 0,17% | 5 Okt 2026 |
|
CVE-2026-19185
The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads...
|
7.8 High | — | 0,11% | 5 Okt 2026 |
|
CVE-2026-19184
The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number of active cha...
|
8.4 High | — | 0,10% | 5 Okt 2026 |
|
CVE-2026-105284
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authenticat...
|
10.0 Critical | — | 0,78% | 5 Okt 2026 |
|
CVE-2026-105263
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/Metada...
|
4.7 Medium | — | 0,23% | 5 Okt 2026 |
|
CVE-2026-105254
A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the ar...
|
6.3 Medium | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-105253
A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. This manipul...
|
7.3 High | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-105251
A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding/psx_decoder.c of the componen...
|
6.3 Medium | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-105069
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issu...
|
6.5 Medium | — | 0,13% | 5 Okt 2026 |
|
CVE-2026-105068
Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Event...
|
5.3 Medium | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-105064
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Add...
|
6.5 Medium | — | 0,24% | 5 Okt 2026 |
|
CVE-2026-105062
Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects...
|
4.3 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-105060
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue...
|
6.5 Medium | — | 0,13% | 5 Okt 2026 |