Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-90918
joomla!
Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vect...
|
5.3 Medium | — | 0,20% | 29 Sep 2026 |
|
CVE-2026-90917
joomla!
Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users...
|
5.3 Medium | — | 0,20% | 29 Sep 2026 |
|
CVE-2026-90916
joomla!
Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorize...
|
2.7 Low | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-90915
joomla!
Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name...
|
6.5 Medium | — | 0,35% | 29 Sep 2026 |
|
CVE-2026-90914
joomla!
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the gene...
|
6.4 Medium | — | 0,22% | 29 Sep 2026 |
|
CVE-2026-90913
joomla!
Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthor...
|
5.5 Medium | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-90907
joomla!
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not...
|
5.3 Medium | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-90906
joomla!
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HT...
|
8.3 High | — | 0,22% | 29 Sep 2026 |
|
CVE-2026-102796
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allow...
|
7.5 High | — | 0,25% | 29 Sep 2026 |
|
CVE-2026-102697
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly p...
|
7.8 High | — | 0,15% | 29 Sep 2026 |
|
CVE-2026-102676
electronjs electron
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <...
|
9.8 Critical | — | 0,48% | 29 Sep 2026 |
|
CVE-2026-102675
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses ser...
|
7.4 High | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-102674
electronjs electron
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opene...
|
6.1 Medium | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-102673
electronjs electron
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandbox...
|
6.1 Medium | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-102635
imagemagick
ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attack...
|
5.3 Medium | — | 0,32% | 29 Sep 2026 |
|
CVE-2026-102634
SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Una...
|
7.5 High | — | 0,58% | 29 Sep 2026 |
|
CVE-2026-102633
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers...
|
5.9 Medium | — | 0,35% | 29 Sep 2026 |
|
CVE-2026-102623
A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual...
|
6.5 Medium | — | 0,31% | 29 Sep 2026 |
|
CVE-2026-102557
gnome libsoup, redhat enterprise linux
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of th...
|
8.6 High | — | 0,27% | 29 Sep 2026 |
|
CVE-2026-102556
gnome libsoup, redhat enterprise linux
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the s...
|
8.6 High | — | 0,27% | 29 Sep 2026 |
|
CVE-2026-102425
Advisory
balbooa forms
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code whic...
|
10.0 Critical | — | 0,39% | 29 Sep 2026 |
|
CVE-2026-102424
balbooa forms
Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts...
|
7.5 High | — | 0,37% | 29 Sep 2026 |
|
CVE-2026-101127
balbooa forms
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's ext...
|
9.4 Critical | — | 0,33% | 29 Sep 2026 |
|
CVE-2026-101126
balbooa forms
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only tha...
|
6.5 Medium | — | 0,25% | 29 Sep 2026 |
|
CVE-2026-101112
balbooa forms
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID...
|
5.3 Medium | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-100245
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows St...
|
6.1 Medium | — | 0,16% | 29 Sep 2026 |
|
CVE-2026-100244
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation.
This issue affects...
|
7.5 High | — | 0,26% | 29 Sep 2026 |
|
CVE-2026-100243
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Sto...
|
6.1 Medium | — | 0,16% | 29 Sep 2026 |
|
CVE-2026-100242
Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Exces...
|
7.5 High | — | 0,34% | 29 Sep 2026 |
|
CVE-2026-100241
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation.
This issue affects Med...
|
7.5 High | — | 0,31% | 29 Sep 2026 |
|
CVE-2026-100240
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.
This i...
|
9.1 Critical | — | 0,30% | 29 Sep 2026 |
|
CVE-2026-100238
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored...
|
6.1 Medium | — | 0,19% | 29 Sep 2026 |
|
CVE-2022-51019
Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell...
|
8.8 High | — | 1,8% | 29 Sep 2026 |
|
CVE-2026-97711
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialize...
|
2.3 Low | — | 0,30% | 29 Sep 2026 |
|
CVE-2026-97689
python urllib3
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because...
|
7.5 High | — | 0,34% | 29 Sep 2026 |
|
CVE-2026-97688
python urllib3
urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate dec...
|
5.3 Medium | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-97687
python urllib3
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, ver...
|
8.1 High | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-93332
Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, an...
|
5.4 Medium | — | 0,17% | 29 Sep 2026 |
|
CVE-2026-93330
Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway ho...
|
4.3 Medium | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-92371
TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By ex...
|
7.0 High | — | 0,11% | 29 Sep 2026 |
|
CVE-2026-92370
An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacke...
|
8.8 High | — | 0,38% | 29 Sep 2026 |
|
CVE-2026-92369
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can...
|
7.3 High | — | 0,09% | 29 Sep 2026 |
|
CVE-2026-92368
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording fil...
|
7.8 High | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-84784
openssl
Issue summary: A malicious remote peer may flood the local QUIC
stack with NEW_CONNECTION_ID frames by avoiding a limit check on
how many connection IDs the remote QUIC s...
|
7.5 High | — | 0,40% | 29 Sep 2026 |
|
CVE-2026-84783
openssl
Issue summary: The first concurrent use of the same X.509 certificate by
several threads may cause its cached extension data to be freed while
another thread is still usi...
|
7.5 High | — | 0,23% | 29 Sep 2026 |
|
CVE-2026-84782
openssl
Issue summary: The DTLS retransmission logic does not correctly handle
a handshake message write that is suspended part-way through.
The retransmitted message can be read...
|
8.2 High | — | 0,39% | 29 Sep 2026 |
|
CVE-2026-77696
openssl
Issue summary: SM2 signature generation uses non-constant-time arithmetic
on secret values, forming a timing side-channel.
Impact summary: An attacker able to measure SM...
|
3.7 Low | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-77177
Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 temp...
|
9.8 Critical | — | 0,59% | 29 Sep 2026 |
|
CVE-2026-75806
openssl
Issue summary: An established DTLS 1.2 association using an AEAD cipher suite
can be terminated by a single unauthenticated datagram whose encrypted
fragment is shorter t...
|
5.3 Medium | — | 0,39% | 29 Sep 2026 |
|
CVE-2026-75805
openssl
Issue summary: A CMP client that requests certificate revocation on the basis
of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when
processing a c...
|
5.3 Medium | — | 0,22% | 29 Sep 2026 |