Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-91012
apache karaf
org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),
which backs the "config" MBean and the config:* shell commands, derives the file
it writes...
|
9.8 Critical | — | 0,63% | 29 Sep 2026 |
|
CVE-2026-84154
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to ex...
|
9.9 Critical | — | 0,36% | 29 Sep 2026 |
|
CVE-2026-101169
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object....
|
8.7 High | — | 0,33% | 29 Sep 2026 |
|
CVE-2026-86158
Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth token...
|
7.7 High | — | 0,09% | 29 Sep 2026 |
|
CVE-2026-86157
Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application la...
|
5.6 Medium | — | 0,12% | 29 Sep 2026 |
|
CVE-2026-102293
A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-ad...
|
7.3 High | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-102292
A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functionality of the...
|
4.3 Medium | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-102290
A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulatio...
|
3.5 Low | — | 0,25% | 29 Sep 2026 |
|
CVE-2026-102264
A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file frontend/update...
|
3.5 Low | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-102263
A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file manage-foo...
|
4.7 Medium | — | 0,22% | 29 Sep 2026 |
|
CVE-2026-102261
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the compon...
|
5.4 Medium | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-97029
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that s...
|
5.7 Medium | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-97024
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (s...
|
7.1 High | — | 0,31% | 29 Sep 2026 |
|
CVE-2026-102422
shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of an...
|
8.1 High | — | 0,38% | 29 Sep 2026 |
|
CVE-2026-102414
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block...
|
3.7 Low | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-102249
A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argume...
|
7.3 High | — | 0,28% | 29 Sep 2026 |
|
CVE-2026-102248
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation...
|
7.3 High | — | 0,38% | 29 Sep 2026 |
|
CVE-2026-102247
A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component Database M...
|
6.8 Medium | — | 0,39% | 29 Sep 2026 |
|
CVE-2026-102245
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook...
|
7.3 High | — | 0,39% | 29 Sep 2026 |
|
CVE-2026-97685
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer id...
|
7.1 High | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-102244
A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the...
|
4.3 Medium | — | 0,23% | 29 Sep 2026 |
|
CVE-2026-102243
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the co...
|
7.4 High | — | 1,2% | 29 Sep 2026 |
|
CVE-2026-102241
A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backup_common.sh of the component B...
|
2.7 Low | — | 0,22% | 29 Sep 2026 |
|
CVE-2026-96326
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versi...
|
7.2 High | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-102240
A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. T...
|
10.0 Critical | — | 2,0% | 29 Sep 2026 |
|
CVE-2026-101878
Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the...
|
7.5 High | — | 0,26% | 29 Sep 2026 |
|
CVE-2026-101860
A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginIns...
|
8.8 High | — | 0,47% | 29 Sep 2026 |
|
CVE-2026-101859
A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/del_ovpncfg.php...
|
5.4 Medium | — | 1,6% | 29 Sep 2026 |
|
CVE-2026-101858
A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager....
|
4.7 Medium | — | 2,1% | 29 Sep 2026 |
|
CVE-2026-101354
A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a man...
|
9.6 Critical | — | 0,38% | 29 Sep 2026 |
|
CVE-2026-102374
GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML...
|
6.1 Medium | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-102373
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate s...
|
6.5 Medium | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-102372
GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript i...
|
6.1 Medium | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-101281
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libop...
|
7.3 High | — | 0,41% | 29 Sep 2026 |
|
CVE-2026-101280
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Hand...
|
7.3 High | — | 0,40% | 29 Sep 2026 |
|
CVE-2026-101279
A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c o...
|
6.5 Medium | — | 0,32% | 29 Sep 2026 |
|
CVE-2026-101278
A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of...
|
4.3 Medium | — | 0,13% | 29 Sep 2026 |
|
CVE-2026-18747
The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with r...
|
6.8 Medium | — | 0,12% | 29 Sep 2026 |
|
CVE-2026-18746
parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer...
|
5.9 Medium | — | 0,25% | 29 Sep 2026 |
|
CVE-2026-18417
The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = INT_TO_POINTE...
|
6.5 Medium | — | 0,18% | 29 Sep 2026 |
|
CVE-2026-102367
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessio...
|
5.4 Medium | — | 0,18% | 29 Sep 2026 |
|
CVE-2026-102366
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without v...
|
4.4 Medium | — | 0,16% | 29 Sep 2026 |
|
CVE-2026-102365
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /use...
|
6.5 Medium | — | 0,24% | 29 Sep 2026 |
|
CVE-2026-102364
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session t...
|
5.4 Medium | — | 0,18% | 29 Sep 2026 |
|
CVE-2026-102363
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment...
|
3.7 Low | — | 0,27% | 29 Sep 2026 |
|
CVE-2026-102362
mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary produ...
|
5.3 Medium | — | 0,29% | 29 Sep 2026 |
|
CVE-2026-102361
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront accou...
|
9.1 Critical | — | 0,37% | 29 Sep 2026 |
|
CVE-2026-101277
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set of the file dkim.c of the compo...
|
6.5 Medium | — | 0,19% | 29 Sep 2026 |
|
CVE-2026-101265
A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such manipulation leads to i...
|
3.1 Low | — | 0,21% | 29 Sep 2026 |
|
CVE-2026-101264
A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument pas...
|
9.1 Critical | — | 2,3% | 29 Sep 2026 |