Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-94483
vercel next.js
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a re...
|
6.5 Medium | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-67989
crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability ma...
|
7.5 High | — | 0,34% | 2 Okt 2026 |
|
CVE-2026-51915
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/c...
|
9.8 Critical | — | 0,58% | 2 Okt 2026 |
|
CVE-2026-51906
In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary...
|
9.1 Critical | — | 0,35% | 2 Okt 2026 |
|
CVE-2026-51918
FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().
|
9.8 Critical | — | 0,60% | 2 Okt 2026 |
|
CVE-2026-51917
FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.
|
7.3 High | — | 0,34% | 2 Okt 2026 |
|
CVE-2026-51914
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_template and p...
|
8.8 High | — | 0,51% | 2 Okt 2026 |
|
CVE-2026-51911
vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigg...
|
9.8 Critical | — | 0,91% | 2 Okt 2026 |
|
CVE-2026-51904
SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and creat...
|
9.8 Critical | — | 0,41% | 2 Okt 2026 |
|
CVE-2026-51916
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source...
|
7.5 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-51907
In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary location...
|
8.1 High | — | 0,39% | 2 Okt 2026 |
|
CVE-2026-51898
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.
|
9.8 Critical | — | 0,33% | 2 Okt 2026 |
|
CVE-2026-51901
SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one...
|
8.1 High | — | 0,25% | 2 Okt 2026 |
|
CVE-2026-51899
In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) a...
|
4.3 Medium | — | 0,19% | 2 Okt 2026 |
|
CVE-2026-104914
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.
When a user queries for soft-deleted attributes (e...
|
5.3 Medium | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-104912
MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the...
|
7.1 High | — | 0,21% | 2 Okt 2026 |
|
CVE-2026-104910
MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retriev...
|
5.3 Medium | — | 0,27% | 2 Okt 2026 |
|
CVE-2026-104908
MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belon...
|
7.1 High | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-104907
MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag...
|
4.8 Medium | — | 0,35% | 2 Okt 2026 |
|
CVE-2026-104906
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rend...
|
6.2 Medium | — | 0,36% | 2 Okt 2026 |
|
CVE-2026-104901
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) M...
|
5.1 Medium | — | 0,32% | 2 Okt 2026 |
|
CVE-2026-104900
MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated...
|
5.3 Medium | — | 0,36% | 2 Okt 2026 |
|
CVE-2026-104847
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attack...
|
8.5 High | — | 0,31% | 2 Okt 2026 |
|
CVE-2026-104846
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulf...
|
9.8 Critical | — | 0,35% | 2 Okt 2026 |
|
CVE-2026-104845
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromC...
|
7.5 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-104844
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat select...
|
5.9 Medium | — | 0,39% | 2 Okt 2026 |
|
CVE-2026-104843
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a...
|
5.9 Medium | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-103631
google chrome
Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromiu...
|
8.8 High | — | 0,46% | 2 Okt 2026 |
|
CVE-2026-103630
google chrome
Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium...
|
9.6 Critical | — | 0,33% | 2 Okt 2026 |
|
CVE-2026-103648
Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destin...
|
9.1 Critical | — | 0,41% | 2 Okt 2026 |
|
CVE-2026-103629
google chrome
Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity:...
|
4.3 Medium | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-103627
google chrome
Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security seve...
|
6.5 Medium | — | 0,25% | 2 Okt 2026 |
|
CVE-2026-103623
google chrome
Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chr...
|
8.8 High | — | 0,30% | 2 Okt 2026 |
|
CVE-2026-103628
google chrome
Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chr...
|
9.6 Critical | — | 0,37% | 2 Okt 2026 |
|
CVE-2026-103626
google chrome
Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute...
|
9.6 Critical | — | 0,33% | 2 Okt 2026 |
|
CVE-2026-103625
google chrome
Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium sec...
|
8.8 High | — | 0,32% | 2 Okt 2026 |
|
CVE-2026-103624
google chrome
Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially...
|
8.3 High | — | 0,28% | 2 Okt 2026 |
|
CVE-2026-103622
google chrome
Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium se...
|
8.8 High | — | 0,30% | 2 Okt 2026 |
|
CVE-2026-103621
google chrome
Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security se...
|
4.3 Medium | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-101104
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do no...
|
7.7 High | — | 0,27% | 2 Okt 2026 |
|
CVE-2026-90970
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4...
|
9.9 Critical | — | 0,94% | 2 Okt 2026 |
|
CVE-2026-5782
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Loglama.net TurkHotspot allows Reflected XSS.
This issue affects Tu...
|
5.2 Medium | — | 0,14% | 2 Okt 2026 |
|
CVE-2026-39717
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPre...
|
4.3 Medium | — | 0,15% | 2 Okt 2026 |
|
CVE-2026-39601
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Con...
|
3.7 Low | — | 0,16% | 2 Okt 2026 |
|
CVE-2026-39600
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing.This issue affects Aculect AI C...
|
4.7 Medium | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-39444
Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control...
|
5.4 Medium | — | 0,19% | 2 Okt 2026 |
|
CVE-2026-39439
Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamu...
|
6.5 Medium | — | 0,19% | 2 Okt 2026 |
|
CVE-2026-32585
Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec...
|
6.5 Medium | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-32584
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allo...
|
5.3 Medium | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-104638
A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown...
|
5.3 Medium | — | 0,43% | 2 Okt 2026 |