Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-75804
openssl
Issue summary: OpenSSL QUIC stack does not enforce connection
level flow control for streams. Remote peers may send more bytes
as long as they fit within the stream flow...
|
5.3 Medium | — | 0,35% | 29 Sep 2026 |
|
CVE-2026-72897
openssl
Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a
connection to a different SSL_CTX part way through a handshake may access
memory beyond the end of an...
|
7.5 High | — | 0,27% | 29 Sep 2026 |
|
CVE-2026-54875
openssl
Issue summary: A non-constant-time optimized implementation of scalar
point multiplication is used for SM2 private key operations on ARM64 and
RISC-V platforms.
Impact s...
|
3.7 Low | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-54873
openssl
Issue summary: QUIC process may keep memory for QUIC packet
buffer for much longer period than necessary.
Impact summary: Remote peer can exploit this vulnerability
by s...
|
7.5 High | — | 0,46% | 29 Sep 2026 |
|
CVE-2026-54872
openssl
Issue summary: The generic elliptic-curve scalar multiplication used for
ECDSA and SM2 signature operations with curves that do not have a dedicated
implementation leaks...
|
3.7 Low | — | 0,26% | 29 Sep 2026 |
|
CVE-2026-42772
openssl
Issue summary: The QUIC stream reassembly algorithm performance deteriorates
progressively as packets are arriving out of order. The worst case has
a quadratic complexity...
|
5.3 Medium | — | 0,33% | 29 Sep 2026 |
|
CVE-2026-35191
openssl
Issue summary: The OpenSSL QUIC server, when configured to not preform address
validation, can be forced to count incoming packets multiple times in its
unvalidated credi...
|
3.7 Low | — | 0,36% | 29 Sep 2026 |
|
CVE-2026-35189
openssl
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL
distribution points causes disproportionate heap growth when OpenSSL caches
X.509 extensions.
Impact s...
|
5.3 Medium | — | 0,27% | 29 Sep 2026 |
|
CVE-2026-19743
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user...
|
7.8 High | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-102630
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attacker...
|
4.7 Medium | — | 0,11% | 29 Sep 2026 |
|
CVE-2026-102601
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem acr...
|
3.5 Low | — | 0,34% | 29 Sep 2026 |
|
CVE-2026-102600
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking...
|
7.5 High | — | 0,37% | 29 Sep 2026 |
|
CVE-2026-102598
Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because...
|
6.3 Medium | — | 0,37% | 29 Sep 2026 |
|
CVE-2026-100308
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating sy...
|
7.8 High | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-100289
Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network...
|
5.0 Medium | — | 0,16% | 29 Sep 2026 |
|
CVE-2026-100288
Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain exte...
|
7.2 High | — | 0,07% | 29 Sep 2026 |
|
CVE-2026-100287
Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or rest...
|
5.4 Medium | — | 0,17% | 29 Sep 2026 |
|
CVE-2026-100286
Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration...
|
6.5 Medium | — | 0,22% | 29 Sep 2026 |
|
CVE-2023-54400
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through...
|
9.8 Critical | — | 0,46% | 29 Sep 2026 |
|
CVE-2026-86035
Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability...
|
8.5 High | — | 0,37% | 29 Sep 2026 |
|
CVE-2026-68911
Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing...
|
8.7 High | — | 0,30% | 29 Sep 2026 |
|
CVE-2026-65102
NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration file. A succe...
|
7.8 High | — | 0,12% | 29 Sep 2026 |
|
CVE-2026-63209
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat ind...
|
7.5 High | — | 0,37% | 29 Sep 2026 |
|
CVE-2026-49243
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable...
|
9.6 Critical | — | 0,30% | 29 Sep 2026 |
|
CVE-2026-22101
The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and W...
|
5.1 Medium | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-22094
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.
|
9.3 Critical | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-102570
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated u...
|
5.5 Medium | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-102569
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into...
|
5.5 Medium | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-102568
Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental contr...
|
5.5 Medium | — | 0,17% | 29 Sep 2026 |
|
CVE-2026-102567
CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers...
|
6.1 Medium | — | 0,12% | 29 Sep 2026 |
|
CVE-2026-102566
CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers c...
|
7.8 High | — | 0,15% | 29 Sep 2026 |
|
CVE-2026-102491
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder o...
|
7.3 High | — | 0,25% | 29 Sep 2026 |
|
CVE-2026-102371
In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client...
|
5.7 Medium | — | 0,11% | 29 Sep 2026 |
|
CVE-2025-33207
NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by...
|
6.8 Medium | — | 0,15% | 29 Sep 2026 |
|
CVE-2015-20122
Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment download end...
|
7.5 High | — | 0,48% | 29 Sep 2026 |
|
CVE-2026-97395
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table m...
|
8.1 High | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-86450
Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality...
|
7.5 High | — | 0,25% | 29 Sep 2026 |
|
CVE-2026-81569
An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can re...
|
4.3 Medium | — | 0,23% | 29 Sep 2026 |
|
CVE-2026-78214
An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incom...
|
5.3 Medium | — | 0,35% | 29 Sep 2026 |
|
CVE-2026-71899
A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the authenticat...
|
6.5 Medium | — | 0,23% | 29 Sep 2026 |
|
CVE-2026-71898
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that pro...
|
4.3 Medium | — | 0,18% | 29 Sep 2026 |
|
CVE-2026-71897
An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects...
|
4.3 Medium | — | 0,18% | 29 Sep 2026 |
|
CVE-2026-4034
Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration...
|
8.7 High | — | 0,26% | 29 Sep 2026 |
|
CVE-2026-102521
The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders...
|
8.6 High | — | 0,26% | 29 Sep 2026 |
|
CVE-2026-102360
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent p...
|
8.6 High | — | 0,42% | 29 Sep 2026 |
|
CVE-2026-98164
linux kernel
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Check write tracking in all address spaces
kvm_gfn_is_write_tracked() checks only the...
|
5.5 Medium | — | 0,15% | 29 Sep 2026 |
|
CVE-2026-96869
Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157...
|
4.3 Medium | — | 0,20% | 29 Sep 2026 |
|
CVE-2026-82973
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token...
|
9.4 Critical | — | 0,42% | 29 Sep 2026 |
|
CVE-2026-82804
The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and exec...
|
8.8 High | — | 0,50% | 29 Sep 2026 |
|
CVE-2026-76875
PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corr...
|
5.3 Medium | — | 0,24% | 29 Sep 2026 |