Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-102115
accellion kiteworks
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a lo...
|
9.8 Critical | — | 1,0% | 30 Sep 2026 |
|
CVE-2026-102114
accellion kiteworks
A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the aff...
|
7.2 High | — | 3,1% | 30 Sep 2026 |
|
CVE-2026-102113
accellion kiteworks
A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the applia...
|
7.8 High | — | 0,39% | 30 Sep 2026 |
|
CVE-2026-102112
accellion kiteworks
A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the applia...
|
7.8 High | — | 0,38% | 30 Sep 2026 |
|
CVE-2026-102111
accellion kiteworks
Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended...
|
4.9 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-102110
accellion kiteworks
An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activa...
|
5.9 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-102109
accellion kiteworks
A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a data...
|
7.1 High | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-102108
accellion kiteworks
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized with...
|
7.2 High | — | 1,5% | 30 Sep 2026 |
|
CVE-2026-102107
accellion kiteworks
Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another...
|
4.6 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-102106
accellion kiteworks
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistent...
|
9.1 Critical | — | 1,1% | 30 Sep 2026 |
|
CVE-2026-102105
accellion kiteworks
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Em...
|
9.1 Critical | — | 0,52% | 30 Sep 2026 |
|
CVE-2026-102104
accellion kiteworks
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Em...
|
9.1 Critical | — | 0,72% | 30 Sep 2026 |
|
CVE-2026-102103
accellion kiteworks
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Em...
|
9.1 Critical | — | 0,72% | 30 Sep 2026 |
|
CVE-2026-102102
accellion kiteworks
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Em...
|
9.1 Critical | — | 0,81% | 30 Sep 2026 |
|
CVE-2026-102101
accellion kiteworks
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allo...
|
8.1 High | — | 0,94% | 30 Sep 2026 |
|
CVE-2026-102100
accellion kiteworks
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authentica...
|
8.7 High | — | 0,34% | 30 Sep 2026 |
|
CVE-2026-102099
accellion kiteworks
Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export featu...
|
7.2 High | — | 2,0% | 30 Sep 2026 |
|
CVE-2026-102098
accellion kiteworks
Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an au...
|
7.2 High | — | 1,00% | 30 Sep 2026 |
|
CVE-2026-102097
accellion kiteworks
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator...
|
7.2 High | — | 2,2% | 30 Sep 2026 |
|
CVE-2026-102096
accellion kiteworks
Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were...
|
7.2 High | — | 3,3% | 30 Sep 2026 |
|
CVE-2026-102095
accellion kiteworks
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of...
|
9.1 Critical | — | 0,41% | 30 Sep 2026 |
|
CVE-2026-102094
accellion kiteworks
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline c...
|
7.2 High | — | 1,5% | 30 Sep 2026 |
|
CVE-2026-102093
accellion kiteworks
Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an au...
|
7.2 High | — | 1,0% | 30 Sep 2026 |
|
CVE-2026-102092
accellion kiteworks
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbit...
|
8.7 High | — | 0,32% | 30 Sep 2026 |
|
CVE-2026-102091
accellion kiteworks
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issu...
|
7.5 High | — | 0,32% | 30 Sep 2026 |
|
CVE-2026-102090
accellion kiteworks
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled do...
|
4.3 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-102089
accellion kiteworks
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administr...
|
7.2 High | — | 1,5% | 30 Sep 2026 |
|
CVE-2026-101276
iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/join...
|
9.2 Critical | — | 0,40% | 30 Sep 2026 |
|
CVE-2024-58387
Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read...
|
7.5 High | — | 0,55% | 30 Sep 2026 |
|
CVE-2023-54403
Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication...
|
7.5 High | — | 0,46% | 30 Sep 2026 |
|
CVE-2023-54402
iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplyin...
|
7.5 High | — | 0,45% | 30 Sep 2026 |
|
CVE-2026-103548
Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 applicati...
|
5.3 Medium | — | 0,10% | 30 Sep 2026 |
|
CVE-2026-103547
In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descri...
|
9.2 Critical | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-103387
A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handl...
|
4.3 Medium | — | 0,32% | 30 Sep 2026 |
|
CVE-2026-102994
pypdf project pypdf
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue f...
|
7.5 High | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-102993
pypdf project pypdf
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels....
|
7.5 High | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-102992
piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits...
|
9.2 Critical | — | 0,43% | 30 Sep 2026 |
|
CVE-2026-102991
Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Tem...
|
6.5 Medium | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-102990
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directo...
|
8.2 High | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-101885
ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest...
|
7.8 High | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-101884
OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA...
|
7.5 High | — | 0,47% | 30 Sep 2026 |
|
CVE-2026-101883
OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by...
|
5.4 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-101882
OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable syst...
|
8.8 High | — | 0,53% | 30 Sep 2026 |
|
CVE-2026-101881
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways t...
|
6.5 Medium | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-101880
OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split...
|
8.8 High | — | 0,69% | 30 Sep 2026 |
|
CVE-2026-101879
OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform...
|
6.5 Medium | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-97291
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
|
8.8 High | — | 0,29% | 30 Sep 2026 |
|
CVE-2026-97290
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.
|
7.1 High | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-97265
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS.
This issue a...
|
6.5 Medium | — | 0,13% | 30 Sep 2026 |
|
CVE-2026-97256
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
|
7.2 High | — | 0,30% | 30 Sep 2026 |