Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-76504
Advisory
cisco catalyst sd-wan manager
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected...
|
9.8 Critical | KEV | 1,8% | 30 Sep 2026 |
|
CVE-2026-74865
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated...
|
9.2 Critical | — | 0,38% | 30 Sep 2026 |
|
CVE-2026-74864
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing...
|
9.3 Critical | — | 0,41% | 30 Sep 2026 |
|
CVE-2026-62085
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
|
7.6 High | — | 0,31% | 30 Sep 2026 |
|
CVE-2026-62083
Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.
|
5.4 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-62081
Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.
|
5.4 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-62080
Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.
|
6.5 Medium | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-62079
Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.
|
6.5 Medium | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-62078
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
|
6.5 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-27371
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-27085
Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.
|
2.7 Low | — | 0,23% | 30 Sep 2026 |
|
CVE-2026-103321
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.
The event graph preview image field was accepted and stored without serv...
|
8.3 High | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-103117
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the compone...
|
4.7 Medium | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-103116
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List...
|
6.3 Medium | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-103115
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Studen...
|
6.3 Medium | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-102399
Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.
|
5.4 Medium | — | 0,10% | 30 Sep 2026 |
|
CVE-2026-102398
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-102396
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-102395
Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-102386
Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.
|
6.5 Medium | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-102385
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-102384
Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.
|
5.9 Medium | — | 0,19% | 30 Sep 2026 |
|
CVE-2026-100513
Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.
|
6.5 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-100508
Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.
|
5.3 Medium | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-100507
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so al...
|
7.1 High | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-88920
apache wss4j
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned...
|
9.8 Critical | — | 0,57% | 30 Sep 2026 |
|
CVE-2026-87830
apache wss4j
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element p...
|
9.1 Critical | — | 0,21% | 30 Sep 2026 |
|
CVE-2026-85532
apache wss4j
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memo...
|
7.5 High | — | 0,55% | 30 Sep 2026 |
|
CVE-2026-62146
A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as...
|
7.8 High | — | 0,11% | 30 Sep 2026 |
|
CVE-2026-10739
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID o...
|
8.5 High | — | 0,12% | 30 Sep 2026 |
|
CVE-2026-10726
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as L...
|
6.8 Medium | — | 0,06% | 30 Sep 2026 |
|
CVE-2026-103242
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing...
|
7.1 High | — | 0,12% | 30 Sep 2026 |
|
CVE-2026-103114
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of t...
|
6.3 Medium | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-103012
Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Ent...
|
2.0 Low | — | 0,11% | 30 Sep 2026 |
|
CVE-2026-96342
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.
|
6.9 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-76992
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker c...
|
7.5 High | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-13720
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through t...
|
5.4 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-13719
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may...
|
4.3 Medium | — | 0,30% | 30 Sep 2026 |
|
CVE-2026-103239
MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload a...
|
8.6 High | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-103113
A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the compon...
|
4.7 Medium | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-94053
Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
Apache MINA SSHD is a Java libr...
|
9.1 Critical | — | 0,38% | 30 Sep 2026 |
|
CVE-2026-94052
A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks....
|
9.1 Critical | — | 0,38% | 30 Sep 2026 |
|
CVE-2026-94029
Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extensio...
|
6.5 Medium | — | 0,38% | 30 Sep 2026 |
|
CVE-2026-94002
Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
Apache
M...
|
7.5 High | — | 0,43% | 30 Sep 2026 |
|
CVE-2026-93996
Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-si...
|
6.5 Medium | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-93995
Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache
MINA SSHD is a Java library for client-side and server-...
|
6.5 Medium | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-93994
Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different...
|
8.1 High | — | 0,32% | 30 Sep 2026 |
|
CVE-2026-79625
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads o...
|
8.1 High | — | 0,23% | 30 Sep 2026 |
|
CVE-2026-77185
Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server....
|
9.1 Critical | — | 0,51% | 30 Sep 2026 |
|
CVE-2026-10764
Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data.
|
8.7 High | — | 0,24% | 30 Sep 2026 |