Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-94652
Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommend...
|
6.3 Medium | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-94648
Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recomm...
|
8.2 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-94646
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerab...
|
8.7 High | — | 0,46% | 2 Okt 2026 |
|
CVE-2026-94638
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recomme...
|
6.3 Medium | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-94637
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings.
This issue affects Apache Thrift: before 0.25.0.
Users...
|
8.2 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-94636
Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input v...
|
8.2 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-92834
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server.
This issue affects Apache Thrift: before 0.25.0.
Use...
|
6.3 Medium | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-90440
Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer....
|
8.2 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-87117
NULL pointer dereference vulnerability in Apache Thrift PHP bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0...
|
8.7 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-86537
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings....
|
8.7 High | — | 0,55% | 2 Okt 2026 |
|
CVE-2026-86536
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
This issue affects Apache Thr...
|
6.3 Medium | — | 0,46% | 2 Okt 2026 |
|
CVE-2026-86535
Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache...
|
8.7 High | — | 0,34% | 2 Okt 2026 |
|
CVE-2026-85088
Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift.
Both libraries install a default access manager for client sockets —...
|
6.9 Medium | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-85087
Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0.
Users...
|
6.9 Medium | — | 0,22% | 2 Okt 2026 |
|
CVE-2026-85086
Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
This issue affects Apache Thrift:...
|
6.9 Medium | — | 0,26% | 2 Okt 2026 |
|
CVE-2026-82459
Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport.
This issue affects Apache Thrift: before 0.25.0...
|
8.2 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-82458
Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust,...
|
8.7 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-61373
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer.
This issue affects Apache Thrift: before 0.25.0.
Us...
|
8.7 High | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-104609
A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file edit_...
|
7.3 High | — | 0,26% | 2 Okt 2026 |
|
CVE-2026-104473
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such...
|
6.1 Medium | — | 0,20% | 2 Okt 2026 |
|
CVE-2026-104472
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Att...
|
7.5 High | — | 0,35% | 2 Okt 2026 |
|
CVE-2026-104471
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory vi...
|
7.2 High | — | 0,37% | 2 Okt 2026 |
|
CVE-2026-104470
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Ba...
|
5.0 Medium | — | 0,24% | 2 Okt 2026 |
|
CVE-2026-104469
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID...
|
6.8 Medium | — | 0,23% | 2 Okt 2026 |
|
CVE-2026-104468
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestam...
|
4.8 Medium | — | 0,25% | 2 Okt 2026 |
|
CVE-2026-104467
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when...
|
8.1 High | — | 0,37% | 2 Okt 2026 |
|
CVE-2026-104466
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event ha...
|
5.4 Medium | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-104465
YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail h...
|
6.1 Medium | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-104464
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidat...
|
8.6 High | — | 0,29% | 2 Okt 2026 |
|
CVE-2026-104463
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activi...
|
7.0 High | — | 0,25% | 2 Okt 2026 |
|
CVE-2026-104462
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attac...
|
7.5 High | — | 0,31% | 2 Okt 2026 |
|
CVE-2026-104461
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPur...
|
5.4 Medium | — | 0,17% | 2 Okt 2026 |
|
CVE-2026-104460
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clau...
|
7.5 High | — | 0,39% | 2 Okt 2026 |
|
CVE-2026-104459
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal...
|
6.5 Medium | — | 0,39% | 2 Okt 2026 |
|
CVE-2026-104458
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4,...
|
6.5 Medium | — | 0,32% | 2 Okt 2026 |
|
CVE-2026-104457
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates the...
|
8.6 High | — | 0,28% | 2 Okt 2026 |
|
CVE-2026-104456
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a rea...
|
7.6 High | — | 0,30% | 2 Okt 2026 |
|
CVE-2026-104455
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RS...
|
5.3 Medium | — | 0,37% | 2 Okt 2026 |
|
CVE-2026-104454
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can s...
|
5.3 Medium | — | 0,40% | 2 Okt 2026 |
|
CVE-2026-104453
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators...
|
5.4 Medium | — | 0,11% | 2 Okt 2026 |
|
CVE-2026-104452
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validatin...
|
5.4 Medium | — | 0,11% | 2 Okt 2026 |
|
CVE-2026-104451
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lack...
|
4.3 Medium | — | 0,13% | 2 Okt 2026 |
|
CVE-2026-104450
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page...
|
6.5 Medium | — | 0,27% | 2 Okt 2026 |
|
CVE-2026-104449
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL rest...
|
6.5 Medium | — | 0,28% | 2 Okt 2026 |
|
CVE-2026-104448
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jso...
|
8.1 High | — | 0,16% | 2 Okt 2026 |
|
CVE-2026-104447
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected...
|
7.1 High | — | 0,13% | 2 Okt 2026 |
|
CVE-2026-104446
YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server...
|
6.5 Medium | — | 0,43% | 2 Okt 2026 |
|
CVE-2026-104445
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor....
|
8.2 High | — | 0,40% | 2 Okt 2026 |
|
CVE-2026-104444
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbit...
|
7.1 High | — | 0,27% | 2 Okt 2026 |
|
CVE-2026-104443
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples rega...
|
8.1 High | — | 0,36% | 2 Okt 2026 |