Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-102906
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child_process.exec of the fil...
|
6.3 Medium | — | 1,1% | 30 Sep 2026 |
|
CVE-2026-102874
A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of the component Execute Endpoint....
|
7.3 High | — | 1,3% | 30 Sep 2026 |
|
CVE-2026-81310
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrar...
|
6.6 Medium | — | 0,12% | 30 Sep 2026 |
|
CVE-2026-78229
Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may ex...
|
6.7 Medium | — | 0,43% | 30 Sep 2026 |
|
CVE-2026-103088
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations...
|
7.5 High | — | 0,69% | 30 Sep 2026 |
|
CVE-2026-103087
Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stac...
|
7.1 High | — | 0,32% | 30 Sep 2026 |
|
CVE-2026-102847
A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application...
|
4.3 Medium | — | 0,27% | 30 Sep 2026 |
|
CVE-2026-102846
A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file app...
|
4.7 Medium | — | 0,23% | 30 Sep 2026 |
|
CVE-2026-102845
A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function error_reporti...
|
5.3 Medium | — | 0,31% | 30 Sep 2026 |
|
CVE-2026-102844
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the fil...
|
2.7 Low | — | 0,26% | 30 Sep 2026 |
|
CVE-2026-102843
A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file applicat...
|
4.7 Medium | — | 0,33% | 30 Sep 2026 |
|
CVE-2026-51936
Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attached database into another. It...
|
2.1 Low | — | 0,18% | 30 Sep 2026 |
|
CVE-2026-103057
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal...
|
4.3 Medium | — | 0,25% | 30 Sep 2026 |
|
CVE-2026-103056
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpol...
|
9.0 Critical | — | 1,5% | 30 Sep 2026 |
|
CVE-2026-103055
AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment...
|
7.5 High | — | 0,40% | 30 Sep 2026 |
|
CVE-2026-103054
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they...
|
7.1 High | — | 0,22% | 30 Sep 2026 |
|
CVE-2026-103053
AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is e...
|
5.4 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-102842
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_user_login_mod...
|
6.3 Medium | — | 0,28% | 30 Sep 2026 |
|
CVE-2026-102805
A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h...
|
6.5 Medium | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-102804
A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave....
|
6.5 Medium | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-90441
watchguard fireware
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-on...
|
8.1 High | — | 0,23% | 30 Sep 2026 |
|
CVE-2026-86136
watchguard fireware
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-on...
|
8.1 High | — | 0,30% | 30 Sep 2026 |
|
CVE-2026-86133
watchguard fireware
An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the ike...
|
7.5 High | — | 0,35% | 30 Sep 2026 |
|
CVE-2026-86132
watchguard fireware
An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially...
|
7.5 High | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-86131
watchguard fireware
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute a...
|
9.8 Critical | — | 0,42% | 30 Sep 2026 |
|
CVE-2026-86128
watchguard fireware
A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by send...
|
7.5 High | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-86105
watchguard fireware
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applic...
|
7.1 High | — | 0,31% | 30 Sep 2026 |
|
CVE-2026-86104
watchguard fireware
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by se...
|
7.5 High | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-86101
watchguard fireware
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to o...
|
6.5 Medium | — | 0,22% | 30 Sep 2026 |
|
CVE-2026-81433
A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network acce...
|
8.7 High | — | 0,20% | 30 Sep 2026 |
|
CVE-2026-18145
watchguard fireware
A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to...
|
7.2 High | — | 0,39% | 30 Sep 2026 |
|
CVE-2026-18105
watchguard fireware
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of t...
|
6.5 Medium | — | 0,24% | 30 Sep 2026 |
|
CVE-2026-13224
watchguard fireware
A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by...
|
4.9 Medium | — | 0,36% | 30 Sep 2026 |
|
CVE-2026-13046
watchguard fireware
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the...
|
7.2 High | — | 0,37% | 30 Sep 2026 |
|
CVE-2026-103051
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows...
|
6.1 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-103050
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows St...
|
6.1 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-103049
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflecte...
|
6.1 Medium | — | 0,16% | 30 Sep 2026 |
|
CVE-2026-103048
URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.
This issue...
|
6.1 Medium | — | 0,15% | 30 Sep 2026 |
|
CVE-2026-102794
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argumen...
|
9.1 Critical | — | 2,4% | 30 Sep 2026 |
|
CVE-2026-102793
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of...
|
9.1 Critical | — | 2,5% | 30 Sep 2026 |
|
CVE-2026-103047
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows St...
|
6.1 Medium | — | 0,16% | 29 Sep 2026 |
|
CVE-2026-103046
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored...
|
6.1 Medium | — | 0,16% | 29 Sep 2026 |
|
CVE-2026-103045
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XS...
|
6.1 Medium | — | 0,16% | 29 Sep 2026 |
|
CVE-2026-103044
XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.
This issue affects Mediawiki...
|
9.8 Critical | — | 0,44% | 29 Sep 2026 |
|
CVE-2026-103043
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can sup...
|
7.5 High | — | 0,45% | 29 Sep 2026 |
|
CVE-2026-103042
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_trans_mode nccl, allowing unauthenticated attackers t...
|
7.5 High | — | 0,52% | 29 Sep 2026 |
|
CVE-2026-103041
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send craft...
|
9.8 Critical | — | 0,62% | 29 Sep 2026 |
|
CVE-2026-103040
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an una...
|
9.8 Critical | — | 0,78% | 29 Sep 2026 |
|
CVE-2026-102792
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The manipulation of the argument c...
|
9.1 Critical | — | 3,0% | 29 Sep 2026 |
|
CVE-2026-91191
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function...
|
7.5 High | — | 0,21% | 29 Sep 2026 |