Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-105178
A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. The impacted element is the function mysqli_real_escape_string of the file /Admin/ad...
|
4.7 Medium | — | 0,32% | 5 Okt 2026 |
|
CVE-2026-105177
A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. The affected element is an unknown function of the file /Admin/add_drug.php of the compon...
|
4.7 Medium | — | 0,32% | 5 Okt 2026 |
|
CVE-2026-105176
A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /Admin/edit_class.php. This manipulation of t...
|
4.7 Medium | — | 0,32% | 5 Okt 2026 |
|
CVE-2026-105295
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TL...
|
7.5 High | — | 0,13% | 5 Okt 2026 |
|
CVE-2026-105294
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord setting...
|
7.4 High | — | 0,19% | 5 Okt 2026 |
|
CVE-2026-105293
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvali...
|
8.1 High | — | 0,38% | 5 Okt 2026 |
|
CVE-2026-105292
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without...
|
5.9 Medium | — | 0,16% | 5 Okt 2026 |
|
CVE-2026-105223
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-aut...
|
7.4 High | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-105175
A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /Auth/add_student.php of the component...
|
7.3 High | — | 0,25% | 5 Okt 2026 |
|
CVE-2026-105174
A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function project_create of the file gerapy/server/core/views.py of the component Pro...
|
5.4 Medium | — | 0,33% | 5 Okt 2026 |
|
CVE-2026-105173
A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of...
|
3.5 Low | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-105172
A vulnerability was detected in itsourcecode Online Admission System 1.0. Affected by this issue is some unknown functionality of the file /login1.php. Performing a manip...
|
7.3 High | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-105171
A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Af...
|
6.3 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-105170
A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an...
|
7.3 High | — | 0,40% | 5 Okt 2026 |
|
CVE-2026-105169
A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This impa...
|
7.3 High | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-105168
A vulnerability was identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects a...
|
6.3 Medium | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-105222
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, whi...
|
7.4 High | — | 0,19% | 4 Okt 2026 |
|
CVE-2026-105221
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection i...
|
7.4 High | — | 0,18% | 4 Okt 2026 |
|
CVE-2026-105220
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attac...
|
7.8 High | — | 0,15% | 4 Okt 2026 |
|
CVE-2026-105167
A vulnerability was determined in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted e...
|
7.3 High | — | 0,27% | 4 Okt 2026 |
|
CVE-2026-105166
A vulnerability was found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected elemen...
|
7.3 High | — | 0,27% | 4 Okt 2026 |
|
CVE-2026-105165
A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component A...
|
6.3 Medium | — | 0,21% | 4 Okt 2026 |
|
CVE-2026-105164
A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulat...
|
2.7 Low | — | 0,54% | 4 Okt 2026 |
|
CVE-2026-105163
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the compone...
|
5.3 Medium | — | 0,32% | 4 Okt 2026 |
|
CVE-2026-105219
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlappi...
|
7.5 High | — | 0,36% | 4 Okt 2026 |
|
CVE-2026-105218
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider...
|
7.4 High | — | 0,16% | 4 Okt 2026 |
|
CVE-2026-105217
Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token....
|
3.1 Low | — | 0,10% | 4 Okt 2026 |
|
CVE-2026-105216
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets I...
|
7.4 High | — | 0,19% | 4 Okt 2026 |
|
CVE-2026-105161
A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation...
|
5.3 Medium | — | 0,14% | 4 Okt 2026 |
|
CVE-2026-105224
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetche...
|
5.4 Medium | — | 0,17% | 4 Okt 2026 |
|
CVE-2026-105089
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video tra...
|
8.7 High | — | 0,23% | 4 Okt 2026 |
|
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entit...
|
8.7 High | — | 0,23% | 4 Okt 2026 |
|
CVE-2026-104402
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects M...
|
4.3 Medium | — | 0,18% | 4 Okt 2026 |
|
CVE-2026-105215
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint tru...
|
9.1 Critical | — | 0,34% | 4 Okt 2026 |
|
CVE-2026-105214
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain...
|
2.3 Low | — | 0,22% | 4 Okt 2026 |
|
CVE-2026-105213
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactiva...
|
8.2 High | — | 0,24% | 4 Okt 2026 |
|
CVE-2026-105212
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enro...
|
7.5 High | — | 0,32% | 4 Okt 2026 |
|
CVE-2026-105211
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via t...
|
8.1 High | — | 0,33% | 4 Okt 2026 |
|
CVE-2026-105210
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handle...
|
8.2 High | — | 0,24% | 4 Okt 2026 |
|
CVE-2026-105209
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only th...
|
9.6 Critical | — | 0,22% | 4 Okt 2026 |
|
CVE-2026-105208
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their...
|
7.7 High | — | 0,08% | 4 Okt 2026 |
|
CVE-2026-105207
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller'...
|
9.8 Critical | — | 0,31% | 4 Okt 2026 |
|
CVE-2026-105206
ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organiz...
|
5.3 Medium | — | 0,28% | 4 Okt 2026 |
|
CVE-2026-105205
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-prote...
|
5.3 Medium | — | 0,22% | 4 Okt 2026 |
|
CVE-2026-105158
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the...
|
7.3 High | — | 0,41% | 4 Okt 2026 |
|
CVE-2026-105157
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do...
|
4.3 Medium | — | 0,45% | 4 Okt 2026 |
|
CVE-2026-105156
A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing...
|
3.7 Low | — | 0,19% | 4 Okt 2026 |
|
CVE-2026-105149
A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of th...
|
7.3 High | — | 0,26% | 4 Okt 2026 |
|
CVE-2026-105148
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval...
|
7.3 High | — | 0,28% | 4 Okt 2026 |
|
CVE-2026-105147
A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_B...
|
7.3 High | — | 0,28% | 4 Okt 2026 |