Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-51861
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.
|
9.8 Critical | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-51860
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.
|
7.5 High | — | 0,59% | 30 Sep 2026 |
|
CVE-2026-51852
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user...
|
7.5 High | — | 0,65% | 30 Sep 2026 |
|
CVE-2026-51859
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).
|
9.1 Critical | — | 0,65% | 30 Sep 2026 |
|
CVE-2026-51858
In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary.
|
9.8 Critical | — | 0,50% | 30 Sep 2026 |
|
CVE-2026-51857
In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.
|
9.8 Critical | — | 0,40% | 30 Sep 2026 |
|
CVE-2026-51856
In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to...
|
9.8 Critical | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-51853
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the...
|
7.5 High | — | 0,65% | 30 Sep 2026 |
|
CVE-2026-51570
modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.
|
8.1 High | — | 0,30% | 30 Sep 2026 |
|
CVE-2026-51568
modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.
|
8.1 High | — | 0,32% | 30 Sep 2026 |
|
CVE-2026-103000
pypdf project pypdf
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_...
|
7.5 High | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-102999
pypdf project pypdf
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in p...
|
7.5 High | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-102998
pypdf project pypdf
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-st...
|
7.5 High | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-102997
pypdf project pypdf
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force py...
|
7.5 High | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-102996
pypdf project pypdf
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array,...
|
7.5 High | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-102995
pypdf project pypdf
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUn...
|
7.5 High | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-102150
accellion kiteworks
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set...
|
7.2 High | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-102149
accellion kiteworks
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate...
|
9.4 Critical | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-102147
accellion kiteworks
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript i...
|
9.3 Critical | — | 0,45% | 30 Sep 2026 |
|
CVE-2026-102146
accellion kiteworks
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locati...
|
6.5 Medium | — | 1,0% | 30 Sep 2026 |
|
CVE-2026-102145
accellion kiteworks
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this i...
|
6.6 Medium | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-102144
accellion kiteworks
A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive serve...
|
5.3 Medium | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-102143
accellion kiteworks
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that di...
|
7.5 High | — | 0,32% | 30 Sep 2026 |
|
CVE-2026-102142
accellion kiteworks
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authentic...
|
7.2 High | — | 1,2% | 30 Sep 2026 |
|
CVE-2026-102141
accellion kiteworks
Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as r...
|
6.7 Medium | — | 0,10% | 30 Sep 2026 |
|
CVE-2026-102140
accellion kiteworks
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's h...
|
4.9 Medium | — | 0,14% | 30 Sep 2026 |
|
CVE-2026-102139
accellion kiteworks
An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the pa...
|
6.5 Medium | — | 0,39% | 30 Sep 2026 |
|
CVE-2026-102138
accellion kiteworks
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without suffici...
|
3.3 Low | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-102137
accellion kiteworks
An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance...
|
4.1 Medium | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-102136
accellion kiteworks
In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was w...
|
6.3 Medium | — | 0,13% | 30 Sep 2026 |
|
CVE-2026-102135
accellion kiteworks
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deseri...
|
6.6 Medium | — | 1,3% | 30 Sep 2026 |
|
CVE-2026-102134
accellion kiteworks
Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticate...
|
5.4 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-102133
accellion kiteworks
An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an exte...
|
6.6 Medium | — | 1,2% | 30 Sep 2026 |
|
CVE-2026-102132
accellion kiteworks
An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being im...
|
7.2 High | — | 1,0% | 30 Sep 2026 |
|
CVE-2026-102131
accellion kiteworks
Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authentica...
|
7.2 High | — | 1,2% | 30 Sep 2026 |
|
CVE-2026-102130
accellion kiteworks
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded i...
|
7.2 High | — | 1,2% | 30 Sep 2026 |
|
CVE-2026-102129
accellion kiteworks
A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose del...
|
7.2 High | — | 0,84% | 30 Sep 2026 |
|
CVE-2026-102128
accellion kiteworks
An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated,...
|
7.5 High | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-102127
accellion kiteworks
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled...
|
7.0 High | — | 0,19% | 30 Sep 2026 |
|
CVE-2026-102126
accellion kiteworks
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted c...
|
8.1 High | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-102125
accellion kiteworks
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could...
|
8.8 High | — | 0,39% | 30 Sep 2026 |
|
CVE-2026-102124
accellion kiteworks
A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network acce...
|
6.5 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-102123
accellion kiteworks
A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file t...
|
7.4 High | — | 0,99% | 30 Sep 2026 |
|
CVE-2026-102122
accellion kiteworks
Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager r...
|
4.3 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-102121
accellion kiteworks
A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it retu...
|
8.6 High | — | 0,45% | 30 Sep 2026 |
|
CVE-2026-102120
accellion kiteworks
A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment t...
|
8.8 High | — | 0,43% | 30 Sep 2026 |
|
CVE-2026-102119
accellion kiteworks
A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feat...
|
7.2 High | — | 1,4% | 30 Sep 2026 |
|
CVE-2026-102118
accellion kiteworks
A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root p...
|
7.8 High | — | 0,40% | 30 Sep 2026 |
|
CVE-2026-102117
accellion kiteworks
On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data...
|
7.2 High | — | 1,3% | 30 Sep 2026 |
|
CVE-2026-102116
accellion kiteworks
-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application t...
|
7.2 High | — | 2,0% | 30 Sep 2026 |