Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-105172
A vulnerability was detected in itsourcecode Online Admission System 1.0. Affected by this issue is some unknown functionality of the file /login1.php. Performing a manip...
|
7.3 High | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-105171
A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Af...
|
6.3 Medium | — | 0,22% | 5 Okt 2026 |
|
CVE-2026-105170
A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an...
|
7.3 High | — | 0,40% | 5 Okt 2026 |
|
CVE-2026-105169
A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This impa...
|
7.3 High | — | 0,26% | 5 Okt 2026 |
|
CVE-2026-105168
A vulnerability was identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects a...
|
6.3 Medium | — | 0,20% | 5 Okt 2026 |
|
CVE-2026-105222
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, whi...
|
7.4 High | — | 0,19% | 4 Okt 2026 |
|
CVE-2026-105221
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection i...
|
7.4 High | — | 0,18% | 4 Okt 2026 |
|
CVE-2026-105220
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attac...
|
7.8 High | — | 0,15% | 4 Okt 2026 |
|
CVE-2026-105167
A vulnerability was determined in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted e...
|
7.3 High | — | 0,27% | 4 Okt 2026 |
|
CVE-2026-105166
A vulnerability was found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected elemen...
|
7.3 High | — | 0,27% | 4 Okt 2026 |
|
CVE-2026-105165
A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component A...
|
6.3 Medium | — | 0,21% | 4 Okt 2026 |
|
CVE-2026-105164
A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulat...
|
2.7 Low | — | 0,54% | 4 Okt 2026 |
|
CVE-2026-105163
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the compone...
|
5.3 Medium | — | 0,32% | 4 Okt 2026 |
|
CVE-2026-105219
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlappi...
|
7.5 High | — | 0,36% | 4 Okt 2026 |
|
CVE-2026-105218
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider...
|
7.4 High | — | 0,16% | 4 Okt 2026 |
|
CVE-2026-105217
Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token....
|
3.1 Low | — | 0,10% | 4 Okt 2026 |
|
CVE-2026-105216
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets I...
|
7.4 High | — | 0,19% | 4 Okt 2026 |
|
CVE-2026-105161
A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation...
|
5.3 Medium | — | 0,14% | 4 Okt 2026 |
|
CVE-2026-105224
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetche...
|
5.4 Medium | — | 0,17% | 4 Okt 2026 |
|
CVE-2026-105089
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video tra...
|
8.7 High | — | 0,23% | 4 Okt 2026 |
|
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entit...
|
8.7 High | — | 0,23% | 4 Okt 2026 |
|
CVE-2026-104402
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects M...
|
4.3 Medium | — | 0,18% | 4 Okt 2026 |
|
CVE-2026-105215
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint tru...
|
9.1 Critical | — | 0,34% | 4 Okt 2026 |
|
CVE-2026-105214
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain...
|
2.3 Low | — | 0,22% | 4 Okt 2026 |
|
CVE-2026-105213
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactiva...
|
8.2 High | — | 0,24% | 4 Okt 2026 |
|
CVE-2026-105212
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enro...
|
7.5 High | — | 0,32% | 4 Okt 2026 |
|
CVE-2026-105211
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via t...
|
8.1 High | — | 0,33% | 4 Okt 2026 |
|
CVE-2026-105210
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handle...
|
8.2 High | — | 0,24% | 4 Okt 2026 |
|
CVE-2026-105209
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only th...
|
9.6 Critical | — | 0,22% | 4 Okt 2026 |
|
CVE-2026-105208
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their...
|
7.7 High | — | 0,08% | 4 Okt 2026 |
|
CVE-2026-105207
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller'...
|
9.8 Critical | — | 0,31% | 4 Okt 2026 |
|
CVE-2026-105206
ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organiz...
|
5.3 Medium | — | 0,28% | 4 Okt 2026 |
|
CVE-2026-105205
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-prote...
|
5.3 Medium | — | 0,22% | 4 Okt 2026 |
|
CVE-2026-105158
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the...
|
7.3 High | — | 0,41% | 4 Okt 2026 |
|
CVE-2026-105157
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do...
|
4.3 Medium | — | 0,45% | 4 Okt 2026 |
|
CVE-2026-105156
A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing...
|
3.7 Low | — | 0,19% | 4 Okt 2026 |
|
CVE-2026-105149
A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of th...
|
7.3 High | — | 0,26% | 4 Okt 2026 |
|
CVE-2026-105148
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval...
|
7.3 High | — | 0,28% | 4 Okt 2026 |
|
CVE-2026-105147
A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_B...
|
7.3 High | — | 0,28% | 4 Okt 2026 |
|
CVE-2026-97307
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data....
|
7.5 High | — | 0,25% | 4 Okt 2026 |
|
CVE-2026-105146
A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/ap...
|
4.7 Medium | — | 0,20% | 4 Okt 2026 |
|
CVE-2026-105145
A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environment of the file goldenverba/components/util.py of...
|
5.3 Medium | — | 0,29% | 4 Okt 2026 |
|
CVE-2026-97276
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This iss...
|
7.1 High | — | 0,15% | 4 Okt 2026 |
|
CVE-2026-105144
A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the com...
|
5.3 Medium | — | 0,54% | 4 Okt 2026 |
|
CVE-2026-105141
A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authenti...
|
6.3 Medium | — | 0,34% | 4 Okt 2026 |
|
CVE-2026-105137
A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation result...
|
5.0 Medium | — | 0,13% | 4 Okt 2026 |
|
CVE-2026-103355
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, A...
|
9.3 Critical | — | 0,25% | 4 Okt 2026 |
|
CVE-2026-103354
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-bl...
|
7.1 High | — | 0,15% | 4 Okt 2026 |
|
CVE-2026-103344
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, A...
|
7.1 High | — | 0,15% | 4 Okt 2026 |
|
CVE-2026-103062
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored...
|
7.1 High | — | 0,15% | 4 Okt 2026 |