Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-93474
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
|
6.5 Medium | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-105046
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
|
4.3 Medium | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-105043
MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.
|
3.6 Low | — | 0,12% | 2 Okt 2026 |
|
CVE-2026-82045
UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.sear...
|
6.5 Medium | — | 0,26% | 2 Okt 2026 |
|
CVE-2026-82044
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources b...
|
7.7 High | — | 0,26% | 2 Okt 2026 |
|
CVE-2026-82043
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing...
|
5.3 Medium | — | 0,25% | 2 Okt 2026 |
|
CVE-2026-82042
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Inte...
|
9.8 Critical | — | 0,55% | 2 Okt 2026 |
|
CVE-2026-82041
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOM...
|
9.9 Critical | — | 0,44% | 2 Okt 2026 |
|
CVE-2026-75937
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root priv...
|
9.4 Critical | — | 0,53% | 2 Okt 2026 |
|
CVE-2026-104874
Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in mult...
|
5.3 Medium | — | 0,30% | 2 Okt 2026 |
|
CVE-2026-104055
The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection error...
|
5.3 Medium | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-82040
UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl() that allows authenticated attackers to make...
|
5.0 Medium | — | 0,19% | 2 Okt 2026 |
|
CVE-2026-82039
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by...
|
8.8 High | — | 0,34% | 2 Okt 2026 |
|
CVE-2026-39718
Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.
|
8.8 High | — | 0,14% | 2 Okt 2026 |
|
CVE-2026-12392
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC s...
|
5.3 Medium | — | 0,27% | 2 Okt 2026 |
|
CVE-2026-104994
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf...
|
2.5 Low | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-104991
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) tha...
|
7.1 High | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-104988
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an...
|
8.1 High | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-104873
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, th...
|
7.6 High | — | 0,25% | 2 Okt 2026 |
|
CVE-2026-104872
OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/inst...
|
5.8 Medium | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-104871
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-pag...
|
6.3 Medium | — | 0,42% | 2 Okt 2026 |
|
CVE-2026-104019
OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x befo...
|
9.0 Critical | — | 1,4% | 2 Okt 2026 |
|
CVE-2026-103918
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimenta...
|
6.5 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-103036
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSc...
|
6.5 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-96940
microsoft exchange server, microsoft exchange server subscription edition
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
|
8.8 High | — | 0,49% | 2 Okt 2026 |
|
CVE-2026-19856
The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones...
|
6.5 Medium | — | 0,18% | 2 Okt 2026 |
|
CVE-2026-103958
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the cr...
|
7.6 High | — | 0,33% | 2 Okt 2026 |
|
CVE-2026-103957
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another u...
|
6.2 Medium | — | 0,38% | 2 Okt 2026 |
|
CVE-2026-103956
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the...
|
10.0 Critical | — | 0,47% | 2 Okt 2026 |
|
CVE-2023-54405
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUplo...
|
9.8 Critical | — | 0,59% | 2 Okt 2026 |
|
CVE-2020-37278
Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a fil...
|
7.5 High | — | 0,36% | 2 Okt 2026 |
|
CVE-2014-125130
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows re...
|
7.5 High | — | 0,53% | 2 Okt 2026 |
|
CVE-2026-59265
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) c...
|
8.8 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-104861
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular ex...
|
7.5 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-104859
Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag,...
|
7.3 High | — | 0,15% | 2 Okt 2026 |
|
CVE-2026-104855
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and...
|
2.0 Low | — | 0,28% | 2 Okt 2026 |
|
CVE-2026-102795
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Use...
|
9.3 Critical | — | 0,28% | 2 Okt 2026 |
|
CVE-2026-102626
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a D...
|
7.2 High | — | 0,27% | 2 Okt 2026 |
|
CVE-2026-104854
Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin wo...
|
8.5 High | — | 0,14% | 2 Okt 2026 |
|
CVE-2026-104853
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value fro...
|
5.8 Medium | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-104851
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem e...
|
8.8 High | — | 0,32% | 2 Okt 2026 |
|
CVE-2026-104849
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options)...
|
9.5 Critical | — | 0,39% | 2 Okt 2026 |
|
CVE-2026-104848
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArg...
|
9.5 Critical | — | 0,50% | 2 Okt 2026 |
|
CVE-2026-96613
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by...
|
6.5 Medium | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-94544
vercel next.js
Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Dr...
|
4.2 Medium | — | 0,18% | 2 Okt 2026 |
|
CVE-2026-94543
vercel next.js
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statical...
|
5.3 Medium | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-51922
agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). Depending on the exposed entry, an attacker can trigger attac...
|
9.8 Critical | — | 0,94% | 2 Okt 2026 |
|
CVE-2026-94486
vercel next.js
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint...
|
5.4 Medium | — | 0,11% | 2 Okt 2026 |
|
CVE-2026-94485
vercel next.js
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoi...
|
5.3 Medium | — | 0,15% | 2 Okt 2026 |
|
CVE-2026-94484
vercel next.js
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically...
|
4.8 Medium | — | 0,24% | 2 Okt 2026 |