Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-101263
A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argu...
|
9.1 Critical | — | 2,3% | 29 Sep 2026 |
|
CVE-2026-102335
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary ngi...
|
7.1 High | — | 0,23% | 28 Sep 2026 |
|
CVE-2026-102334
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any acco...
|
7.4 High | — | 0,45% | 28 Sep 2026 |
|
CVE-2026-102333
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded...
|
6.1 Medium | — | 0,21% | 28 Sep 2026 |
|
CVE-2026-102332
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label contain...
|
6.1 Medium | — | 0,32% | 28 Sep 2026 |
|
CVE-2026-101262
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the ar...
|
9.1 Critical | — | 2,4% | 28 Sep 2026 |
|
CVE-2026-101261
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument log...
|
9.1 Critical | — | 2,4% | 28 Sep 2026 |
|
CVE-2026-101260
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manip...
|
9.1 Critical | — | 2,3% | 28 Sep 2026 |
|
CVE-2026-102297
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call t...
|
4.3 Medium | — | 0,22% | 28 Sep 2026 |
|
CVE-2026-102296
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to...
|
6.5 Medium | — | 0,37% | 28 Sep 2026 |
|
CVE-2026-102281
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can te...
|
7.5 High | — | 0,38% | 28 Sep 2026 |
|
CVE-2026-101205
A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds...
|
6.3 Medium | — | 0,23% | 28 Sep 2026 |
|
CVE-2026-101204
A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulat...
|
6.3 Medium | — | 0,23% | 28 Sep 2026 |
|
CVE-2026-101203
A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipulation leads...
|
6.3 Medium | — | 0,23% | 28 Sep 2026 |
|
CVE-2026-101202
A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipulation can le...
|
6.3 Medium | — | 0,23% | 28 Sep 2026 |
|
CVE-2026-101188
A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation l...
|
8.3 High | — | 0,45% | 28 Sep 2026 |
|
CVE-2026-101093
Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attac...
|
5.4 Medium | — | 0,12% | 28 Sep 2026 |
|
CVE-2026-101092
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthor...
|
5.3 Medium | — | 0,24% | 28 Sep 2026 |
|
CVE-2026-101091
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents...
|
7.1 High | — | 0,26% | 28 Sep 2026 |
|
CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parame...
|
6.5 Medium | — | 0,37% | 28 Sep 2026 |
|
CVE-2024-42002
A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal C...
|
8.4 High | — | 0,16% | 28 Sep 2026 |
|
CVE-2026-97027
Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of...
|
3.6 Low | — | 0,13% | 28 Sep 2026 |
|
CVE-2026-97026
Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other l...
|
3.9 Low | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-97025
Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a mult...
|
3.2 Low | — | 0,13% | 28 Sep 2026 |
|
CVE-2026-91096
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to un...
|
7.5 High | — | 0,26% | 28 Sep 2026 |
|
CVE-2026-91095
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream...
|
5.3 Medium | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-84895
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method...
|
7.3 High | — | 0,19% | 28 Sep 2026 |
|
CVE-2026-18416
The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= op...
|
3.7 Low | — | 0,22% | 28 Sep 2026 |
|
CVE-2026-18415
ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame_buf_pool, sized IEEE802154_MT...
|
6.3 Medium | — | 0,10% | 28 Sep 2026 |
|
CVE-2026-18414
The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drive...
|
7.8 High | — | 0,12% | 28 Sep 2026 |
|
CVE-2026-18413
The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drive...
|
7.8 High | — | 0,12% | 28 Sep 2026 |
|
CVE-2026-16513
The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle a...
|
7.8 High | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-102279
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js toolt...
|
3.1 Low | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-102278
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause...
|
7.5 High | — | 0,35% | 28 Sep 2026 |
|
CVE-2026-102277
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untr...
|
5.3 Medium | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-102276
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhau...
|
7.5 High | — | 0,35% | 28 Sep 2026 |
|
CVE-2026-102275
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK i...
|
8.2 High | — | 0,14% | 28 Sep 2026 |
|
CVE-2026-102274
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK component...
|
7.5 High | — | 0,39% | 28 Sep 2026 |
|
CVE-2026-102273
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes...
|
7.4 High | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-102272
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detecto...
|
7.4 High | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-102271
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on...
|
7.4 High | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-102270
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively....
|
4.9 Medium | — | 0,21% | 28 Sep 2026 |
|
CVE-2026-102269
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters o...
|
5.4 Medium | — | 0,19% | 28 Sep 2026 |
|
CVE-2026-102268
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PE...
|
9.1 Critical | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-102267
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the...
|
9.1 Critical | — | 0,16% | 28 Sep 2026 |
|
CVE-2026-102266
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decode...
|
9.1 Critical | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-102265
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but no...
|
5.3 Medium | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-102006
In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory...
|
5.5 Medium | — | 0,10% | 28 Sep 2026 |
|
CVE-2026-102005
Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the sys...
|
5.5 Medium | — | 0,10% | 28 Sep 2026 |
|
CVE-2026-101918
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser cat...
|
7.5 High | — | 0,36% | 28 Sep 2026 |