Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-102303
google chrome
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi...
|
4.3 Medium | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-102302
google chrome
Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium se...
|
8.8 High | — | 0,35% | 29 Sep 2026 |
|
CVE-2026-102301
google chrome
Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary cod...
|
8.3 High | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-102300
google chrome
Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security...
|
4.3 Medium | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-102299
google chrome
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium sec...
|
8.8 High | — | 0,41% | 29 Sep 2026 |
|
CVE-2026-102252
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the s...
|
6.9 Medium | — | 0,09% | 29 Sep 2026 |
|
CVE-2026-100299
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption.
|
6.8 Medium | — | 0,09% | 29 Sep 2026 |
|
CVE-2026-100298
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended...
|
8.8 High | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-100297
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network...
|
5.3 Medium | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-100296
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the ad...
|
8.1 High | — | 0,34% | 29 Sep 2026 |
|
CVE-2026-100295
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal...
|
6.3 Medium | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-100294
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the publ...
|
7.5 High | — | 0,23% | 29 Sep 2026 |
|
CVE-2026-100293
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on...
|
8.8 High | — | 0,18% | 29 Sep 2026 |
|
CVE-2026-100292
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a...
|
8.8 High | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-100291
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allo...
|
9.8 Critical | — | 0,33% | 29 Sep 2026 |
|
CVE-2024-31027
Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name,...
|
5.4 Medium | — | 0,26% | 29 Sep 2026 |
|
CVE-2024-31026
An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course modul...
|
9.8 Critical | — | 0,59% | 29 Sep 2026 |
|
CVE-2026-102831
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6...
|
8.1 High | — | 0,20% | 29 Sep 2026 |
|
CVE-2026-102830
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6...
|
6.8 Medium | — | 0,26% | 29 Sep 2026 |
|
CVE-2026-102829
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-p...
|
9.2 Critical | — | 0,27% | 29 Sep 2026 |
|
CVE-2026-102828
simple-git project simple-git
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the...
|
9.8 Critical | — | 0,38% | 29 Sep 2026 |
|
CVE-2026-102827
simple-git project simple-git
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default...
|
9.8 Critical | — | 0,40% | 29 Sep 2026 |
|
CVE-2026-102826
simple-git project simple-git
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default...
|
8.1 High | — | 0,46% | 29 Sep 2026 |
|
CVE-2026-102825
Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self...
|
3.7 Low | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-102824
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-by...
|
4.3 Medium | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-102823
Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, C...
|
7.5 High | — | 0,26% | 29 Sep 2026 |
|
CVE-2026-102822
Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher b...
|
3.7 Low | — | 0,33% | 29 Sep 2026 |
|
CVE-2026-102821
Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then...
|
6.5 Medium | — | 0,30% | 29 Sep 2026 |
|
CVE-2026-102820
pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3,...
|
6.2 Medium | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-102616
A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the...
|
7.3 High | — | 0,25% | 29 Sep 2026 |
|
CVE-2026-95385
google chrome
Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypas...
|
6.5 Medium | — | 0,30% | 29 Sep 2026 |
|
CVE-2026-95384
google chrome
Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML pag...
|
5.3 Medium | — | 0,23% | 29 Sep 2026 |
|
CVE-2026-95382
google chrome
Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineer...
|
6.5 Medium | — | 0,32% | 29 Sep 2026 |
|
CVE-2026-95381
google chrome
Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute ar...
|
8.3 High | — | 0,43% | 29 Sep 2026 |
|
CVE-2026-95380
google chrome
Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sand...
|
8.8 High | — | 0,45% | 29 Sep 2026 |
|
CVE-2026-95376
google chrome
Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access res...
|
8.0 High | — | 0,20% | 29 Sep 2026 |
|
CVE-2026-95375
google chrome
Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin poli...
|
6.3 Medium | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-95374
google chrome
Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium securi...
|
6.5 Medium | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-95373
google chrome
Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox vi...
|
8.8 High | — | 0,39% | 29 Sep 2026 |
|
CVE-2026-95372
google chrome
Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary c...
|
8.3 High | — | 0,40% | 29 Sep 2026 |
|
CVE-2026-95371
google chrome
Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social e...
|
5.4 Medium | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-95370
google chrome
Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chrom...
|
5.4 Medium | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-95369
google chrome
Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craft...
|
8.8 High | — | 0,41% | 29 Sep 2026 |
|
CVE-2026-95368
google chrome
Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin dat...
|
4.3 Medium | — | 0,25% | 29 Sep 2026 |
|
CVE-2026-95367
google chrome
Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineeri...
|
5.3 Medium | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-95366
google chrome
Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy vi...
|
6.5 Medium | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-95365
google chrome
Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
|
8.8 High | — | 0,45% | 29 Sep 2026 |
|
CVE-2026-95364
google chrome
Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security...
|
5.4 Medium | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-95363
google chrome
UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML...
|
5.4 Medium | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-95362
google chrome
Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a c...
|
8.8 High | — | 0,21% | 29 Sep 2026 |