Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-101908
Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then...
|
6.9 Medium | — | 0,41% | 28 Sep 2026 |
|
CVE-2026-101907
Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios reque...
|
7.0 High | — | 0,41% | 28 Sep 2026 |
|
CVE-2026-101906
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to...
|
8.2 High | — | 0,40% | 28 Sep 2026 |
|
CVE-2026-101905
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without...
|
7.6 High | — | 0,29% | 28 Sep 2026 |
|
CVE-2026-101904
Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from...
|
6.9 Medium | — | 0,43% | 28 Sep 2026 |
|
CVE-2026-101903
Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the m...
|
8.2 High | — | 0,38% | 28 Sep 2026 |
|
CVE-2026-101902
Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can re...
|
6.9 Medium | — | 0,41% | 28 Sep 2026 |
|
CVE-2026-101901
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Sessio...
|
8.2 High | — | 0,38% | 28 Sep 2026 |
|
CVE-2026-101900
Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders prope...
|
6.9 Medium | — | 0,55% | 28 Sep 2026 |
|
CVE-2026-101898
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and call...
|
7.0 High | — | 0,53% | 28 Sep 2026 |
|
CVE-2026-101102
A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function run_code of the component Code Mode Sandbox. The manipulation results...
|
6.3 Medium | — | 0,22% | 28 Sep 2026 |
|
CVE-2026-101101
A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middlew...
|
4.3 Medium | — | 0,35% | 28 Sep 2026 |
|
CVE-2026-101100
A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/cli...
|
5.4 Medium | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-101099
A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part of the file SseParser.kt of the component Kotlin Community SDK. Perfor...
|
4.3 Medium | — | 0,51% | 28 Sep 2026 |
|
CVE-2026-88816
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName.
fetchrow_hashref uses the string pointer of the FetchHashKeyName attr...
|
7.5 High | — | 0,62% | 28 Sep 2026 |
|
CVE-2026-88815
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.
When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string p...
|
6.2 Medium | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-87969
An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplyin...
|
8.6 High | — | 1,2% | 28 Sep 2026 |
|
CVE-2026-87114
A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of mere...
|
7.1 High | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-86102
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on th...
|
9.3 Critical | — | 2,0% | 28 Sep 2026 |
|
CVE-2026-85644
XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.
The wrapper function XS::Parse::Infix generates for a list-associative in...
|
7.5 High | — | 0,39% | 28 Sep 2026 |
|
CVE-2026-55096
fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the serv...
|
7.1 High | — | 0,21% | 28 Sep 2026 |
|
CVE-2026-54160
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1a...
|
8.2 High | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-48100
Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the compacted message stream from...
|
8.7 High | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-101894
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do n...
|
9.1 Critical | — | 0,81% | 28 Sep 2026 |
|
CVE-2026-101891
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain...
|
9.3 Critical | — | 0,27% | 28 Sep 2026 |
|
CVE-2026-101098
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.j...
|
4.3 Medium | — | 0,51% | 28 Sep 2026 |
|
CVE-2026-101083
A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. Impacted is an unknown function in the library encryptionhelper.dll. Such manipulation leads to inf...
|
5.3 Medium | — | 0,32% | 28 Sep 2026 |
|
CVE-2026-101082
A weakness has been identified in PMWeb 7.x/8.x/2025.x. This issue affects some unknown processing of the file downloader.aspx. This manipulation of the argument FullFile...
|
5.3 Medium | — | 0,54% | 28 Sep 2026 |
|
CVE-2026-101081
A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the component Web...
|
9.1 Critical | — | 0,54% | 28 Sep 2026 |
|
CVE-2026-97399
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a progra...
|
3.7 Low | — | 0,29% | 28 Sep 2026 |
|
CVE-2026-93348
Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile...
|
8.1 High | — | 0,41% | 28 Sep 2026 |
|
CVE-2026-91154
Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerc...
|
6.9 Medium | — | 0,39% | 28 Sep 2026 |
|
CVE-2026-88808
suse rancher fleet
A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of...
|
8.8 High | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-88805
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15...
|
8.1 High | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-88804
An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15...
|
9.6 Critical | — | 0,60% | 28 Sep 2026 |
|
CVE-2026-12342
This vulnerability
impacts all versions of IdentityIQ and allows an unauthenticated user remote
code execution on the IdentityIQ server due to improper input validation o...
|
9.6 Critical | — | 0,19% | 28 Sep 2026 |
|
CVE-2026-101861
Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval() vulnerability in schema.py that allows authenticated attackers to achieve code execution b...
|
4.1 Medium | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-101080
A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the co...
|
4.8 Medium | — | 0,14% | 28 Sep 2026 |
|
CVE-2026-101079
A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/ana...
|
2.8 Low | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-101078
A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.t...
|
6.3 Medium | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-101077
A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authenti...
|
10.0 Critical | — | 0,71% | 28 Sep 2026 |
|
CVE-2026-101076
A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. The manipulat...
|
10.0 Critical | — | 2,0% | 28 Sep 2026 |
|
CVE-2026-96538
WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file functions pg_file_write(text,text...
|
8.7 High | — | 0,32% | 28 Sep 2026 |
|
CVE-2026-93540
suse rancher fleet
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulti...
|
6.5 Medium | — | 0,17% | 28 Sep 2026 |
|
CVE-2026-93539
suse rancher fleet
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accept...
|
5.4 Medium | — | 0,23% | 28 Sep 2026 |
|
CVE-2026-93538
suse rancher fleet
A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, in...
|
7.1 High | — | 0,17% | 28 Sep 2026 |
|
CVE-2026-80359
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the S...
|
6.8 Medium | — | 0,15% | 28 Sep 2026 |
|
CVE-2026-80358
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the S...
|
5.1 Medium | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-80357
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the S...
|
7.0 High | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-70413
Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potent...
|
5.6 Medium | — | 0,09% | 28 Sep 2026 |