Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-53953
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be acces...
|
9.1 Critical | — | 0,34% | 1 Okt 2026 |
|
CVE-2026-14984
Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or...
|
9.4 Critical | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-14983
Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against...
|
7.1 High | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-104286
fortinet fortimail
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6,...
|
9.8 Critical | KEV | 2,2% | 1 Okt 2026 |
|
CVE-2026-103484
IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.
|
8.8 High | — | 0,42% | 1 Okt 2026 |
|
CVE-2026-102671
The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default.
|
5.3 Medium | — | 0,13% | 1 Okt 2026 |
|
CVE-2026-102670
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.
|
4.3 Medium | — | 0,11% | 1 Okt 2026 |
|
CVE-2026-102669
Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages.
|
5.3 Medium | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-102668
The Joyland AI app accepts any TLS certificates from any server without validation.
|
5.3 Medium | — | 0,12% | 1 Okt 2026 |
|
CVE-2026-102667
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could acce...
|
8.3 High | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-102666
The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications...
|
6.5 Medium | — | 0,17% | 1 Okt 2026 |
|
CVE-2026-102628
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthentic...
|
9.3 Critical | — | 0,34% | 1 Okt 2026 |
|
CVE-2026-100251
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to ac...
|
6.5 Medium | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-8618
A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length b...
|
7.7 High | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-84682
A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductV...
|
7.7 High | — | 1,0% | 1 Okt 2026 |
|
CVE-2026-55232
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with...
|
7.6 High | — | 0,32% | 1 Okt 2026 |
|
CVE-2026-55231
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an...
|
7.2 High | — | 0,52% | 1 Okt 2026 |
|
CVE-2026-55230
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip ev...
|
8.7 High | — | 0,32% | 1 Okt 2026 |
|
CVE-2026-55083
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2...
|
9.1 Critical | — | 0,57% | 1 Okt 2026 |
|
CVE-2026-27872
- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force).
This issue affects Easy IO FG: before 2.0b52.
|
5.6 Medium | — | 0,09% | 1 Okt 2026 |
|
CVE-2026-104056
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned disco...
|
9.8 Critical | — | 0,17% | 1 Okt 2026 |
|
CVE-2026-15911
Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.
|
7.4 High | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-104059
Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing...
|
8.1 High | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-104058
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router gr...
|
5.3 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-104057
Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its We...
|
7.5 High | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-97662
An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwr...
|
8.2 High | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-9032
Tapo C120 v1 and C200 v5
contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without
authentication after initi...
|
7.1 High | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-78578
Tapo C120 v1 and C200 v5
do not enforce authentication for do method HTTPS onboarding connect actions
after initial setup. An unauthenticated adjacent
attacker can submi...
|
7.1 High | — | 0,25% | 1 Okt 2026 |
|
CVE-2026-78577
Tapo C120 v1 and C200 V5
contain a vulnerability in the HTTPS onboarding scan function due to missing authentication.
After initial setup, an unauthenticated attacker on...
|
5.3 Medium | — | 0,15% | 1 Okt 2026 |
|
CVE-2026-73976
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing...
|
7.1 High | — | 0,36% | 1 Okt 2026 |
|
CVE-2026-68496
The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxName...
|
7.5 High | — | 0,67% | 1 Okt 2026 |
|
CVE-2026-68495
The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameL...
|
7.5 High | — | 0,67% | 1 Okt 2026 |
|
CVE-2026-56098
A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the regis...
|
4.3 Medium | — | 0,31% | 1 Okt 2026 |
|
CVE-2026-56097
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parame...
|
6.5 Medium | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-12545
A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due t...
|
6.7 Medium | — | 0,51% | 1 Okt 2026 |
|
CVE-2026-12542
redhat satellite, theforeman foreman
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied argu...
|
7.8 High | — | 0,56% | 1 Okt 2026 |
|
CVE-2026-104018
An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under...
|
8.8 High | — | 0,64% | 1 Okt 2026 |
|
CVE-2026-103923
KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the render...
|
2.1 Low | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-103922
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard va...
|
9.3 Critical | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-103884
A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the fil...
|
6.5 Medium | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-102369
Tapo C120 v1 and C200 V5
do not adequately protect login challenge data or sanitize
attacker-controlled input processed by the MacTool handler. An unauthenticated
attacke...
|
8.7 High | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-102294
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into...
|
8.5 High | — | 0,92% | 1 Okt 2026 |
|
CVE-2023-54404
Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory...
|
7.5 High | — | 0,35% | 1 Okt 2026 |
|
CVE-2026-96659
redhat satellite, theforeman foreman
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting...
|
9.1 Critical | — | 0,32% | 1 Okt 2026 |
|
CVE-2026-96658
redhat satellite, theforeman foreman
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the tem...
|
9.9 Critical | — | 0,69% | 1 Okt 2026 |
|
CVE-2026-93546
apache http server
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently cor...
|
8.8 High | — | 0,44% | 1 Okt 2026 |
|
CVE-2026-79768
apache http server
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the...
|
5.3 Medium | — | 0,59% | 1 Okt 2026 |
|
CVE-2026-77387
geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior w...
|
4.0 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-73975
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-m...
|
8.4 High | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-73637
apache http server
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authent...
|
7.3 High | — | 0,48% | 1 Okt 2026 |