Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-94276
Improper Authentication vulnerability in Apache APISIX.
On a route using openid-connect plugin with remote introspection against an authorization server that serves mult...
|
5.1 Medium | — | 0,49% | 1 Okt 2026 |
|
CVE-2026-94269
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX.
In some configurations where a permissive route overlaps a protected one, a...
|
6.3 Medium | — | 0,42% | 1 Okt 2026 |
|
CVE-2026-94250
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX.
An unauthenticated caller can drive a gateway worker into...
|
8.2 High | — | 0,32% | 1 Okt 2026 |
|
CVE-2026-94220
Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX.
An attacker who can get a user to click a crafted link may c...
|
2.1 Low | — | 0,22% | 1 Okt 2026 |
|
CVE-2026-94212
Improper verification of cryptographic signature vulnerability in Apache APISIX.
Any unauthenticated attacker could impersonate any user on every route protected by th...
|
6.4 Medium | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-103858
MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the applic...
|
5.3 Medium | — | 0,22% | 1 Okt 2026 |
|
CVE-2026-103754
A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/work...
|
5.9 Medium | — | 0,34% | 1 Okt 2026 |
|
CVE-2026-103680
A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When...
|
3.1 Low | — | 0,33% | 1 Okt 2026 |
|
CVE-2026-103679
A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format (TNEF) file containin...
|
6.5 Medium | — | 0,28% | 1 Okt 2026 |
|
CVE-2026-103678
tnef project tnef
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because th...
|
8.1 High | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-103336
Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive D...
|
5.3 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-88789
Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0 before 3.33.3 and fro...
|
8.6 High | — | 0,52% | 1 Okt 2026 |
|
CVE-2026-82806
Exposure of data element to wrong session vulnerability in Apache APISIX.
This issue affects Apache APISIX: from 2.3.0 before 3.7.0.
Under a supported authz-keycloa...
|
5.3 Medium | — | 0,40% | 1 Okt 2026 |
|
CVE-2026-78242
Insertion of sensitive information into log file vulnerability in Apache APISIX.
This vulnerability can cause the unmasked header value to be written to the log sink u...
|
5.7 Medium | — | 0,15% | 1 Okt 2026 |
|
CVE-2026-103758
Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mc...
|
8.1 High | — | 0,22% | 1 Okt 2026 |
|
CVE-2026-103757
Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUt...
|
7.7 High | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-103353
Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a...
|
5.3 Medium | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-103292
Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}} helper. An authenticated...
|
8.0 High | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-103291
Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigge...
|
6.4 Medium | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-103290
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied fil...
|
3.8 Low | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-103289
Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to...
|
6.5 Medium | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-103288
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can...
|
6.5 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103287
Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers...
|
2.7 Low | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103286
Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to hig...
|
7.3 High | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-103285
Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on...
|
4.3 Medium | — | 0,10% | 1 Okt 2026 |
|
CVE-2026-103284
Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access me...
|
4.3 Medium | — | 0,17% | 1 Okt 2026 |
|
CVE-2026-103283
Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the passwor...
|
8.1 High | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-103282
Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invi...
|
4.3 Medium | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-103281
Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privile...
|
5.4 Medium | — | 0,16% | 1 Okt 2026 |
|
CVE-2026-103280
Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the...
|
5.3 Medium | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-103279
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user...
|
6.8 Medium | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-103278
Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with co...
|
7.3 High | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-103277
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts....
|
8.1 High | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-103276
Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers...
|
5.3 Medium | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-103275
Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restric...
|
4.3 Medium | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-103274
Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restric...
|
5.3 Medium | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-103273
Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictio...
|
4.3 Medium | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-103272
Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers c...
|
7.5 High | — | 0,37% | 1 Okt 2026 |
|
CVE-2026-103271
Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass conten...
|
7.5 High | — | 0,38% | 1 Okt 2026 |
|
CVE-2026-103269
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have a...
|
5.3 Medium | — | 0,24% | 1 Okt 2026 |
|
CVE-2026-103268
Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password r...
|
8.8 High | — | 0,32% | 1 Okt 2026 |
|
CVE-2026-103267
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their...
|
4.3 Medium | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-103266
Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to...
|
7.1 High | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-103265
fleetdm fleet
Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command re...
|
4.3 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103264
fleetdm fleet
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addi...
|
9.1 Critical | — | 0,31% | 1 Okt 2026 |
|
CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved targe...
|
5.9 Medium | — | 0,52% | 1 Okt 2026 |
|
CVE-2026-103262
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sen...
|
7.5 High | — | 0,53% | 1 Okt 2026 |
|
CVE-2026-103261
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending req...
|
5.3 Medium | — | 0,47% | 1 Okt 2026 |
|
CVE-2026-103260
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit re...
|
4.0 Medium | — | 0,28% | 1 Okt 2026 |
|
CVE-2026-103259
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers wit...
|
7.6 High | — | 0,24% | 1 Okt 2026 |