Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-51895
Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perform unautho...
|
6.5 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-51882
The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations out...
|
9.1 Critical | — | 0,42% | 1 Okt 2026 |
|
CVE-2026-51888
langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is...
|
7.5 High | — | 0,56% | 1 Okt 2026 |
|
CVE-2026-51886
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py...
|
9.8 Critical | — | 0,40% | 1 Okt 2026 |
|
CVE-2026-51894
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a...
|
6.5 Medium | — | 0,16% | 1 Okt 2026 |
|
CVE-2026-51893
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant identifier...
|
9.8 Critical | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-51892
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.
|
6.5 Medium | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-51884
The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an a...
|
9.8 Critical | — | 0,51% | 1 Okt 2026 |
|
CVE-2026-51883
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequen...
|
9.1 Critical | — | 0,35% | 1 Okt 2026 |
|
CVE-2026-51878
deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn. A remote caller can enumerate or...
|
4.3 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-51873
Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.
|
8.8 High | — | 0,69% | 1 Okt 2026 |
|
CVE-2026-51881
deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-...
|
9.8 Critical | — | 0,33% | 1 Okt 2026 |
|
CVE-2026-51876
DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_...
|
9.1 Critical | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-51880
deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write...
|
9.8 Critical | — | 0,40% | 1 Okt 2026 |
|
CVE-2026-51879
deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and...
|
9.1 Critical | — | 0,28% | 1 Okt 2026 |
|
CVE-2026-51875
In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project...
|
9.1 Critical | — | 0,35% | 1 Okt 2026 |
|
CVE-2026-51874
In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project...
|
7.5 High | — | 0,33% | 1 Okt 2026 |
|
CVE-2026-34494
- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations.
This issue affects Neo Series MVP2: befor...
|
7.2 High | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-34493
- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations.
This issue affects EasyIO FS32: before 3.3b63...
|
7.2 High | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-27873
- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying.
This issue affects EasyIO FG: before 2.0b52.
|
5.6 Medium | — | 0,09% | 1 Okt 2026 |
|
CVE-2026-18397
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management...
|
9.4 Critical | — | 0,34% | 1 Okt 2026 |
|
CVE-2026-104356
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete...
|
5.9 Medium | — | 0,31% | 1 Okt 2026 |
|
CVE-2026-104051
PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by ca...
|
8.2 High | — | 0,37% | 1 Okt 2026 |
|
CVE-2026-104002
A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that the applicat...
|
5.3 Medium | — | 0,31% | 1 Okt 2026 |
|
CVE-2026-96780
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when...
|
8.2 High | — | 0,40% | 1 Okt 2026 |
|
CVE-2026-71451
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection.
This issue affects EasyIO FS32: before 3.0b63.
|
5.6 Medium | — | 0,43% | 1 Okt 2026 |
|
CVE-2026-55396
Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) an...
|
8.5 High | — | 0,11% | 1 Okt 2026 |
|
CVE-2026-55395
Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to acce...
|
9.4 Critical | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-55394
Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify sessi...
|
5.3 Medium | — | 0,11% | 1 Okt 2026 |
|
CVE-2026-55393
Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to rea...
|
10.0 Critical | — | 0,43% | 1 Okt 2026 |
|
CVE-2026-27874
: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials.
This issue affects EasyIO FS32:...
|
5.0 Medium | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-104183
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object propertie...
|
5.1 Medium | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-104182
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/p...
|
6.2 Medium | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-104181
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management...
|
5.4 Medium | — | 0,34% | 1 Okt 2026 |
|
CVE-2026-104020
Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulti...
|
7.5 High | — | 0,44% | 1 Okt 2026 |
|
CVE-2026-102514
Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an att...
|
8.4 High | — | 0,13% | 1 Okt 2026 |
|
CVE-2026-102370
Kasa EC70 v4
and EC71 v4 do not logically disable the production debug interface at the
firmware or chip level and do not lock the bootloader. Although the debug traces...
|
5.4 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-93832
A component of one of the Motorola system applications was
exported without permission, allowing for the revocation of runtime permissions
from other apps.
|
4.4 Medium | — | 0,09% | 1 Okt 2026 |
|
CVE-2026-82358
RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate...
|
6.5 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-82357
RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have...
|
6.5 Medium | — | 0,29% | 1 Okt 2026 |
|
CVE-2026-71542
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable...
|
8.7 High | — | 0,40% | 1 Okt 2026 |
|
CVE-2026-71426
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with pa...
|
7.1 High | — | 0,34% | 1 Okt 2026 |
|
CVE-2026-70650
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross...
|
8.8 High | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-56662
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no...
|
9.6 Critical | — | 0,22% | 1 Okt 2026 |
|
CVE-2026-56661
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-sup...
|
7.5 High | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-56660
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php do...
|
9.1 Critical | — | 0,53% | 1 Okt 2026 |
|
CVE-2026-55252
OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on red...
|
5.1 Medium | — | 0,32% | 1 Okt 2026 |
|
CVE-2026-55251
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows...
|
6.5 Medium | — | 0,11% | 1 Okt 2026 |
|
CVE-2026-54049
Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic an...
|
8.7 High | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-53964
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code exe...
|
7.2 High | — | 0,49% | 1 Okt 2026 |