Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-102495
apache xmlschema
Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes...
|
7.5 High | — | 0,53% | 29 Sep 2026 |
|
CVE-2026-101266
A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.
|
1.3 Low | — | 0,27% | 29 Sep 2026 |
|
CVE-2026-95509
Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading...
|
8.8 High | — | 0,31% | 29 Sep 2026 |
|
CVE-2026-96423
wireshark
X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
7.1 High | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-96422
wireshark
Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
5.5 Medium | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-96421
wireshark
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
5.5 Medium | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-96420
wireshark
Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
5.5 Medium | — | 0,12% | 29 Sep 2026 |
|
CVE-2026-96419
wireshark
Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution
|
7.8 High | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-96418
wireshark
TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
5.5 Medium | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-96417
wireshark
RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
5.5 Medium | — | 0,15% | 29 Sep 2026 |
|
CVE-2026-96416
wireshark
IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
5.5 Medium | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-96415
wireshark
Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
5.5 Medium | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-95395
wireshark
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
5.5 Medium | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-95394
wireshark
Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
4.7 Medium | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-95393
wireshark
CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
4.7 Medium | — | 0,12% | 29 Sep 2026 |
|
CVE-2026-95392
wireshark
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
5.5 Medium | — | 0,15% | 29 Sep 2026 |
|
CVE-2026-95391
wireshark
ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service
|
5.5 Medium | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-95390
wireshark
PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service
|
5.5 Medium | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-95389
wireshark
SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
8.1 High | — | 0,38% | 29 Sep 2026 |
|
CVE-2026-95388
wireshark
Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
5.5 Medium | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-95387
wireshark
SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
|
8.8 High | — | 0,26% | 29 Sep 2026 |
|
CVE-2026-95386
wireshark
TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service
|
5.5 Medium | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-8937
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions co...
|
4.3 Medium | — | 0,26% | 29 Sep 2026 |
|
CVE-2026-8067
An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the r...
|
6.5 Medium | — | 0,32% | 29 Sep 2026 |
|
CVE-2026-8066
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrit...
|
9.1 Critical | — | 0,74% | 29 Sep 2026 |
|
CVE-2026-8065
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrar...
|
9.1 Critical | — | 0,58% | 29 Sep 2026 |
|
CVE-2026-86843
apache-airflow-providers-teradata
The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the co...
|
6.3 Medium | — | 0,86% | 29 Sep 2026 |
|
CVE-2026-84739
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions c...
|
8.7 High | — | 0,47% | 29 Sep 2026 |
|
CVE-2026-81930
apache-airflow-providers-snowflake
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is b...
|
6.3 Medium | — | 0,43% | 29 Sep 2026 |
|
CVE-2026-81914
apache-airflow-providers-google
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escapin...
|
4.3 Medium | — | 0,51% | 29 Sep 2026 |
|
CVE-2026-81862
apache-airflow-providers-teradata
Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOperator` interp...
|
6.5 Medium | — | 0,40% | 29 Sep 2026 |
|
CVE-2026-76720
A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect.
|
4.3 Medium | — | 0,17% | 29 Sep 2026 |
|
CVE-2026-7395
Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and int...
|
8.5 High | — | 0,25% | 29 Sep 2026 |
|
CVE-2026-76719
A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions.
|
8.2 High | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-76718
A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.
|
8.2 High | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-4523
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions c...
|
3.7 Low | — | 0,35% | 29 Sep 2026 |
|
CVE-2026-19547
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource f...
|
7.0 High | — | 0,16% | 29 Sep 2026 |
|
CVE-2026-15390
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic ca...
|
9.0 Critical | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-11796
Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could resu...
|
5.1 Medium | — | 0,25% | 29 Sep 2026 |
|
CVE-2026-10518
gitlab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could...
|
4.3 Medium | — | 0,33% | 29 Sep 2026 |
|
CVE-2026-102474
A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local...
|
4.0 Medium | — | 0,14% | 29 Sep 2026 |
|
CVE-2026-102473
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who ca...
|
5.5 Medium | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-96440
Improper Limitation of a Pathname to a Restricted
Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp
API endpoint of Flowring Agentflow 4.0 version bef...
|
7.1 High | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-96431
Unrestricted Upload of File with Dangerous Type in the
/WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version
before 2023/03/24 allows remote a...
|
9.3 Critical | — | 0,27% | 29 Sep 2026 |
|
CVE-2026-96430
Exposed Dangerous Method or Function in the
/WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote
authenticated users to exe...
|
8.7 High | — | 0,23% | 29 Sep 2026 |
|
CVE-2026-96429
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API
endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows
remote attackers to execute arbitrary SQL...
|
9.3 Critical | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-96428
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL c...
|
9.3 Critical | — | 0,34% | 29 Sep 2026 |
|
CVE-2026-92142
apache karaf
Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX c...
|
8.8 High | — | 0,60% | 29 Sep 2026 |
|
CVE-2026-91085
apache karaf
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.check...
|
6.3 Medium | — | 0,37% | 29 Sep 2026 |
|
CVE-2026-91048
apache karaf
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rul...
|
9.8 Critical | — | 0,54% | 29 Sep 2026 |