Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-84409
The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management...
|
7.5 High | — | 0,39% | 29 Sep 2026 |
|
CVE-2026-74225
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. A...
|
7.1 High | — | 0,23% | 29 Sep 2026 |
|
CVE-2026-74222
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the c...
|
8.2 High | — | 0,30% | 29 Sep 2026 |
|
CVE-2026-74221
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can...
|
8.2 High | — | 0,34% | 29 Sep 2026 |
|
CVE-2026-74220
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS REA...
|
8.2 High | — | 0,34% | 29 Sep 2026 |
|
CVE-2026-72510
The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.
|
9.0 Critical | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-72507
The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.
|
9.0 Critical | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-71974
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size against partition bounds. Attackers...
|
4.8 Medium | — | 0,18% | 29 Sep 2026 |
|
CVE-2026-71973
U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when allocating the directory table buffer. Attackers can sup...
|
5.2 Medium | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-71972
U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a cr...
|
5.9 Medium | — | 0,22% | 29 Sep 2026 |
|
CVE-2026-71971
U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers ca...
|
8.2 High | — | 0,38% | 29 Sep 2026 |
|
CVE-2026-71379
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.
|
10.0 Critical | — | 0,44% | 29 Sep 2026 |
|
CVE-2026-71302
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID a...
|
7.1 High | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-71189
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser...
|
3.5 Low | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-70356
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
|
9.1 Critical | — | 0,40% | 29 Sep 2026 |
|
CVE-2026-69662
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
|
3.7 Low | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-68954
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.
|
9.0 Critical | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-68068
The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vuln...
|
9.0 Critical | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-63713
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.
|
9.0 Critical | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-102771
A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/adm...
|
4.7 Medium | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-102621
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation l...
|
3.3 Low | — | 0,11% | 29 Sep 2026 |
|
CVE-2026-96587
The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform...
|
10.0 Critical | — | 0,34% | 29 Sep 2026 |
|
CVE-2026-94952
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the rout...
|
9.8 Critical | — | 0,30% | 29 Sep 2026 |
|
CVE-2026-94204
The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Becau...
|
7.5 High | — | 0,27% | 29 Sep 2026 |
|
CVE-2026-93853
Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a sn...
|
7.2 High | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-81842
An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements A...
|
4.3 Medium | — | 0,20% | 29 Sep 2026 |
|
CVE-2026-81841
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashb...
|
5.3 Medium | — | 0,37% | 29 Sep 2026 |
|
CVE-2026-102938
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg f...
|
5.8 Medium | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-102937
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts...
|
7.3 High | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-102930
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic upd...
|
7.7 High | — | 0,16% | 29 Sep 2026 |
|
CVE-2026-102925
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values alr...
|
7.8 High | — | 0,15% | 29 Sep 2026 |
|
CVE-2026-102904
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6...
|
5.4 Medium | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-102620
A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This man...
|
3.3 Low | — | 0,11% | 29 Sep 2026 |
|
CVE-2026-102253
iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into a...
|
7.5 High | — | 0,43% | 29 Sep 2026 |
|
CVE-2026-96274
In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Beca...
|
7.4 High | — | 0,16% | 29 Sep 2026 |
|
CVE-2026-94953
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the rout...
|
8.8 High | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-79538
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport,...
|
9.8 Critical | — | 0,43% | 29 Sep 2026 |
|
CVE-2026-79537
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session store (getSession in session-lif...
|
9.1 Critical | — | 0,31% | 29 Sep 2026 |
|
CVE-2026-79536
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensiti...
|
9.1 Critical | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-79535
mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config set" CLI) writes a caller-supplied value into ~/....
|
6.3 Medium | — | 0,51% | 29 Sep 2026 |
|
CVE-2026-79534
mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystemserver/handler/helper.go). When...
|
5.9 Medium | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-79417
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restricti...
|
5.3 Medium | — | 0,26% | 29 Sep 2026 |
|
CVE-2026-79403
An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint
|
8.4 High | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-79348
KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/se...
|
4.3 Medium | — | 0,20% | 29 Sep 2026 |
|
CVE-2026-76738
A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause...
|
2.7 Low | — | 0,23% | 29 Sep 2026 |
|
CVE-2026-76737
An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with admi...
|
3.0 Low | — | 0,10% | 29 Sep 2026 |
|
CVE-2026-76736
A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow a low-privilege authenticated...
|
3.3 Low | — | 0,09% | 29 Sep 2026 |
|
CVE-2026-76735
A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authentica...
|
4.1 Medium | — | 0,09% | 29 Sep 2026 |
|
CVE-2026-76734
A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of service att...
|
4.8 Medium | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-76733
A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cau...
|
4.9 Medium | — | 0,31% | 29 Sep 2026 |