Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-82827
Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to gene...
|
9.8 Critical | — | 0,27% | 1 Okt 2026 |
|
CVE-2026-82826
Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authen...
|
7.5 High | — | 0,18% | 1 Okt 2026 |
|
CVE-2026-82825
Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critic...
|
9.8 Critical | — | 0,34% | 1 Okt 2026 |
|
CVE-2026-82824
Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files.
This...
|
9.8 Critical | — | 0,38% | 1 Okt 2026 |
|
CVE-2026-78210
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required author...
|
7.1 High | — | 0,26% | 1 Okt 2026 |
|
CVE-2026-76147
A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote...
|
5.9 Medium | — | 0,40% | 1 Okt 2026 |
|
CVE-2026-76146
An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remote...
|
8.4 High | — | 1,9% | 1 Okt 2026 |
|
CVE-2026-76145
An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OS account...
|
7.5 High | — | 0,23% | 1 Okt 2026 |
|
CVE-2026-76144
An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacker to upload a dangerous file...
|
1.8 Low | — | 0,10% | 1 Okt 2026 |
|
CVE-2026-76143
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.
|
7.3 High | — | 0,31% | 1 Okt 2026 |
|
CVE-2026-76142
Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke in...
|
9.3 Critical | — | 0,33% | 1 Okt 2026 |
|
CVE-2026-12241
The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capa...
|
5.4 Medium | — | 0,20% | 1 Okt 2026 |
|
CVE-2026-103539
A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controll...
|
5.4 Medium | — | 0,32% | 1 Okt 2026 |
|
CVE-2026-103538
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/...
|
6.5 Medium | — | 0,44% | 1 Okt 2026 |
|
CVE-2026-103536
A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/...
|
7.3 High | — | 0,40% | 1 Okt 2026 |
|
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 Th...
|
7.2 High | — | 0,33% | 1 Okt 2026 |
|
CVE-2026-92245
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive'...
|
7.5 High | — | 0,43% | 1 Okt 2026 |
|
CVE-2026-91109
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_...
|
6.5 Medium | — | 0,32% | 1 Okt 2026 |
|
CVE-2026-103641
A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file...
|
5.5 Medium | — | 0,14% | 1 Okt 2026 |
|
CVE-2026-103534
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots o...
|
6.3 Medium | — | 0,21% | 1 Okt 2026 |
|
CVE-2026-92537
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9...
|
5.3 Medium | — | 0,32% | 1 Okt 2026 |
|
CVE-2026-103533
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Reques...
|
4.1 Medium | — | 0,29% | 1 Okt 2026 |
|
CVE-2026-101887
BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-ad...
|
3.5 Low | — | 0,15% | 1 Okt 2026 |
|
CVE-2026-93495
Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device.
Refe...
|
7.0 High | — | 0,16% | 1 Okt 2026 |
|
CVE-2026-14157
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded throu...
|
9.4 Critical | — | 0,76% | 1 Okt 2026 |
|
CVE-2026-13313
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable...
|
8.9 High | — | 0,68% | 1 Okt 2026 |
|
CVE-2026-103532
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component S...
|
5.3 Medium | — | 0,31% | 1 Okt 2026 |
|
CVE-2026-103531
A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcos_construct_fci_44 of the file src/libopensc/card-setcos.c. Executing a manipulati...
|
5.5 Medium | — | 0,19% | 1 Okt 2026 |
|
CVE-2026-103530
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search...
|
7.3 High | — | 0,30% | 1 Okt 2026 |
|
CVE-2026-103592
simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypas...
|
6.5 Medium | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-103591
DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers...
|
7.5 High | — | 0,43% | 30 Sep 2026 |
|
CVE-2026-103590
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authentica...
|
5.4 Medium | — | 0,19% | 30 Sep 2026 |
|
CVE-2026-103589
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field...
|
5.4 Medium | — | 0,19% | 30 Sep 2026 |
|
CVE-2026-103588
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a m...
|
5.4 Medium | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-103587
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where date_to and id_room_type...
|
5.4 Medium | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-103585
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site...
|
1.2 Low | — | 0,30% | 30 Sep 2026 |
|
CVE-2026-103584
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-S...
|
1.1 Low | — | 0,29% | 30 Sep 2026 |
|
CVE-2026-47096
AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious Jav...
|
6.1 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-103001
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable optio...
|
6.5 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-101283
iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext len...
|
9.2 Critical | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-92173
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an...
|
9.1 Critical | — | 0,29% | 30 Sep 2026 |
|
CVE-2026-92172
Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbit...
|
8.8 High | — | 0,29% | 30 Sep 2026 |
|
CVE-2026-51872
Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.
|
9.8 Critical | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-51869
DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.
|
9.8 Critical | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-51862
DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validate...
|
9.1 Critical | — | 0,74% | 30 Sep 2026 |
|
CVE-2026-51871
Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by...
|
9.8 Critical | — | 0,40% | 30 Sep 2026 |
|
CVE-2026-51870
DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.
|
9.8 Critical | — | 0,91% | 30 Sep 2026 |
|
CVE-2026-51867
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or...
|
9.8 Critical | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-51866
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.
|
9.8 Critical | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-51864
DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker c...
|
9.1 Critical | — | 0,74% | 30 Sep 2026 |