Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-4556
Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [Cons...
|
7.8 High | — | 0,89% | 28 Sep 2026 |
|
CVE-2026-101333
A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener i...
|
3.7 Low | — | 0,23% | 28 Sep 2026 |
|
CVE-2026-101075
A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /location_time.cgi of the component Locat...
|
10.0 Critical | — | 2,5% | 28 Sep 2026 |
|
CVE-2026-101074
A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Exe...
|
9.8 Critical | — | 1,3% | 28 Sep 2026 |
|
CVE-2026-101073
A security flaw has been discovered in Netcore NR289-GE 1.4.5102. Impacted is an unknown function of the file /bin/boa of the component CGI Dispatcher. Performing a manip...
|
8.3 High | — | 0,63% | 28 Sep 2026 |
|
CVE-2026-97335
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an aut...
|
7.7 High | — | 0,21% | 28 Sep 2026 |
|
CVE-2026-93537
suse rancher fleet
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a Gi...
|
6.5 Medium | — | 0,31% | 28 Sep 2026 |
|
CVE-2026-90926
Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code In...
|
8.8 High | — | 0,29% | 28 Sep 2026 |
|
CVE-2026-90925
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsig...
|
7.1 High | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-90924
Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Pa...
|
9.8 Critical | — | 0,27% | 28 Sep 2026 |
|
CVE-2026-87799
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated...
|
9.9 Critical | — | 0,41% | 28 Sep 2026 |
|
CVE-2026-87798
Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux...
|
5.8 Medium | — | 0,19% | 28 Sep 2026 |
|
CVE-2026-86595
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection....
|
8.8 High | — | 0,24% | 28 Sep 2026 |
|
CVE-2026-86335
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other pr...
|
6.3 Medium | — | 0,22% | 28 Sep 2026 |
|
CVE-2026-86334
Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote...
|
4.2 Medium | — | 0,34% | 28 Sep 2026 |
|
CVE-2026-85526
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace ar...
|
9.9 Critical | — | 0,52% | 28 Sep 2026 |
|
CVE-2026-85185
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client wi...
|
9.6 Critical | — | 0,36% | 28 Sep 2026 |
|
CVE-2026-73642
Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to an...
|
9.2 Critical | — | 0,42% | 28 Sep 2026 |
|
CVE-2026-73641
Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaSc...
|
5.1 Medium | — | 0,33% | 28 Sep 2026 |
|
CVE-2026-73640
Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of...
|
9.3 Critical | — | 0,29% | 28 Sep 2026 |
|
CVE-2026-15953
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600).
This issue affects Prote...
|
5.0 Medium | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-15952
Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600).
This issue affects Protection and control IED man...
|
6.4 Medium | — | 0,09% | 28 Sep 2026 |
|
CVE-2026-101072
A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such manipulation...
|
10.0 Critical | — | 2,0% | 28 Sep 2026 |
|
CVE-2026-101071
A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the c...
|
6.3 Medium | — | 0,27% | 28 Sep 2026 |
|
CVE-2026-101070
A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js...
|
5.3 Medium | — | 0,74% | 28 Sep 2026 |
|
CVE-2026-86330
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud...
|
7.2 High | — | 2,2% | 28 Sep 2026 |
|
CVE-2026-82936
mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for J...
|
5.9 Medium | — | 0,17% | 28 Sep 2026 |
|
CVE-2026-82935
mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly...
|
6.9 Medium | — | 0,37% | 28 Sep 2026 |
|
CVE-2026-82933
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cle...
|
6.0 Medium | — | 0,21% | 28 Sep 2026 |
|
CVE-2026-82932
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully expose...
|
5.3 Medium | — | 0,17% | 28 Sep 2026 |
|
CVE-2026-82930
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An...
|
6.4 Medium | — | 0,22% | 28 Sep 2026 |
|
CVE-2026-82929
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the fir...
|
6.3 Medium | — | 0,24% | 28 Sep 2026 |
|
CVE-2026-82928
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via ke...
|
7.7 High | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-82326
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targ...
|
4.1 Medium | — | 0,15% | 28 Sep 2026 |
|
CVE-2026-82323
Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows Exploitation of Trusted Identifiers.
This i...
|
8.1 High | — | 0,26% | 28 Sep 2026 |
|
CVE-2026-59563
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent...
|
4.6 Medium | — | 0,13% | 28 Sep 2026 |
|
CVE-2026-52749
The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid ses...
|
5.3 Medium | — | 0,26% | 28 Sep 2026 |
|
CVE-2026-52748
The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote attacker to tr...
|
7.1 High | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-18825
An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated re...
|
5.3 Medium | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-12265
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database op...
|
8.8 High | — | 0,88% | 28 Sep 2026 |
|
CVE-2026-101292
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(...
|
8.2 High | — | 0,43% | 28 Sep 2026 |
|
CVE-2026-101069
A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/src/controllers/databaseConnections.js of the compo...
|
6.5 Medium | — | 0,76% | 28 Sep 2026 |
|
CVE-2026-101068
A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the comp...
|
6.5 Medium | — | 0,76% | 28 Sep 2026 |
|
CVE-2026-101067
A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile of the file files.js of the component save-upload...
|
7.3 High | — | 0,69% | 28 Sep 2026 |
|
CVE-2026-101066
A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component...
|
7.3 High | — | 0,69% | 28 Sep 2026 |
|
CVE-2026-101055
A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the component TCP Service. The manipula...
|
5.3 Medium | — | 0,46% | 28 Sep 2026 |
|
CVE-2026-94194
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an in...
|
6.3 Medium | — | 0,33% | 28 Sep 2026 |
|
CVE-2026-92103
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per con...
|
6.3 Medium | — | 0,33% | 28 Sep 2026 |
|
CVE-2026-91043
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a d...
|
8.2 High | — | 0,42% | 28 Sep 2026 |
|
CVE-2026-87752
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd...
|
6.1 Medium | — | 0,15% | 28 Sep 2026 |