Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-101917
pyjwt project pyjwt
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes witho...
|
7.5 High | — | 0,42% | 28 Sep 2026 |
|
CVE-2026-101916
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authori...
|
7.4 High | — | 0,21% | 28 Sep 2026 |
|
CVE-2026-101187
A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/api/zrUsb.lua...
|
9.1 Critical | — | 2,3% | 28 Sep 2026 |
|
CVE-2026-101146
A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard....
|
4.3 Medium | — | 0,27% | 28 Sep 2026 |
|
CVE-2026-101145
A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component Use...
|
4.3 Medium | — | 0,22% | 28 Sep 2026 |
|
CVE-2026-101144
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder....
|
6.3 Medium | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-100392
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization...
|
7.0 High | — | 0,23% | 28 Sep 2026 |
|
CVE-2026-100371
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::change_password(),...
|
8.7 High | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-100370
DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the hre...
|
4.7 Medium | — | 0,27% | 28 Sep 2026 |
|
CVE-2026-96760
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object...
|
9.8 Critical | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-93355
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing use...
|
8.1 High | — | 0,27% | 28 Sep 2026 |
|
CVE-2026-87741
The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_disp...
|
8.8 High | — | 0,40% | 28 Sep 2026 |
|
CVE-2026-86950
Advisory
apple ipados, apple iphone os +1 lainnya
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. P...
|
8.8 High | KEV | 1,2% | 28 Sep 2026 |
|
CVE-2026-102004
Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09
|
7.8 High | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-101915
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws a...
|
3.7 Low | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-101914
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used b...
|
6.5 Medium | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-101143
A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zo...
|
4.3 Medium | — | 0,36% | 28 Sep 2026 |
|
CVE-2026-101142
A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality of the file Scorecard.jsp of the component Q...
|
6.3 Medium | — | 0,34% | 28 Sep 2026 |
|
CVE-2026-101141
A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page. Executing...
|
3.5 Low | — | 0,19% | 28 Sep 2026 |
|
CVE-2026-97686
Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file...
|
5.5 Medium | — | 0,10% | 28 Sep 2026 |
|
CVE-2026-97023
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen...
|
7.1 High | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-84894
In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's...
|
7.5 High | — | 0,26% | 28 Sep 2026 |
|
CVE-2026-13018
google chrome
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access...
|
4.3 Medium | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-102010
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update...
|
7.0 High | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-101139
A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the compon...
|
2.7 Low | — | 0,32% | 28 Sep 2026 |
|
CVE-2026-101132
A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src...
|
3.1 Low | — | 0,44% | 28 Sep 2026 |
|
CVE-2026-101131
A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of the componen...
|
3.3 Low | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-101111
ordasoft book library
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default....
|
6.1 Medium | — | 0,15% | 28 Sep 2026 |
|
CVE-2026-101110
Advisory
ordasoft book library
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction req...
|
9.8 Critical | — | 0,32% | 28 Sep 2026 |
|
CVE-2026-101109
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request p...
|
5.3 Medium | — | 0,26% | 28 Sep 2026 |
|
CVE-2026-101108
Advisory
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort...
|
9.3 Critical | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-101105
A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofile_form of the file /create_profile of the compon...
|
6.3 Medium | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-100753
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopula...
|
5.3 Medium | — | 0,26% | 28 Sep 2026 |
|
CVE-2026-100752
Advisory
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three sep...
|
9.3 Critical | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-96740
A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api Admi...
|
6.5 Medium | — | 0,41% | 28 Sep 2026 |
|
CVE-2026-75600
sangoma freepbx
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execut...
|
8.8 High | — | 0,81% | 28 Sep 2026 |
|
CVE-2026-55160
Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user...
|
7.6 High | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-55157
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0,...
|
8.4 High | — | 0,71% | 28 Sep 2026 |
|
CVE-2026-55156
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0,...
|
5.3 Medium | — | 0,45% | 28 Sep 2026 |
|
CVE-2026-54710
sangoma freepbx
FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe...
|
8.8 High | — | 0,51% | 28 Sep 2026 |
|
CVE-2026-54708
sangoma freepbx
FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers t...
|
8.8 High | — | 0,53% | 28 Sep 2026 |
|
CVE-2026-54675
sangoma freepbx
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that all...
|
8.8 High | — | 0,66% | 28 Sep 2026 |
|
CVE-2026-54674
sangoma freepbx
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX...
|
8.8 High | — | 0,88% | 28 Sep 2026 |
|
CVE-2026-49994
Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /ap...
|
9.1 Critical | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-45562
sangoma freepbx
FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated...
|
7.2 High | — | 0,36% | 28 Sep 2026 |
|
CVE-2026-101913
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes onl...
|
6.3 Medium | — | 0,39% | 28 Sep 2026 |
|
CVE-2026-101912
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts co...
|
6.3 Medium | — | 0,37% | 28 Sep 2026 |
|
CVE-2026-101911
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in...
|
6.3 Medium | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-101910
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts doe...
|
6.9 Medium | — | 0,39% | 28 Sep 2026 |
|
CVE-2026-101909
Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options a...
|
8.3 High | — | 0,35% | 28 Sep 2026 |