Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-78424
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s i...
|
8.8 High | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-19444
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar insi...
|
6.5 Medium | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-12264
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.
|
8.8 High | — | 2,0% | 28 Sep 2026 |
|
CVE-2026-101054
A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file of the file /tmp/wpa_supplicant.conf of the component TCP Service. The...
|
5.3 Medium | — | 0,29% | 28 Sep 2026 |
|
CVE-2026-101053
A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP Service. Exe...
|
7.3 High | — | 0,35% | 28 Sep 2026 |
|
CVE-2026-101052
A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts...
|
7.3 High | — | 0,45% | 28 Sep 2026 |
|
CVE-2026-91006
apache karaf
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it throug...
|
8.8 High | — | 1,1% | 28 Sep 2026 |
|
CVE-2026-81867
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform all...
|
9.4 Critical | — | 0,36% | 28 Sep 2026 |
|
CVE-2026-81375
A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authent...
|
8.3 High | — | 0,32% | 28 Sep 2026 |
|
CVE-2026-19759
An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an...
|
9.4 Critical | — | 0,24% | 28 Sep 2026 |
|
CVE-2026-12269
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow a...
|
8.8 High | — | 7,0% | 28 Sep 2026 |
|
CVE-2026-12268
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.
|
8.8 High | — | 4,7% | 28 Sep 2026 |
|
CVE-2026-12267
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.
|
7.2 High | — | 3,6% | 28 Sep 2026 |
|
CVE-2026-101040
A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813. This affects an unknown part of the component HTTP Multipart...
|
6.5 Medium | — | 0,42% | 28 Sep 2026 |
|
CVE-2026-101039
A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. Affected by this issue is the function copy_msg_element of the component devdiscover Service. Such manipul...
|
10.0 Critical | — | 0,74% | 28 Sep 2026 |
|
CVE-2026-101038
A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability is the function MmtAtePrase of the component MmtAtePrase Parser. This m...
|
9.9 Critical | — | 0,45% | 28 Sep 2026 |
|
CVE-2026-90979
apache karaf
LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the lo...
|
7.3 High | — | 0,44% | 28 Sep 2026 |
|
CVE-2026-7172
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter:
* CVE-2026-7172: parameter 'Nombre Completo' in the endpoint '/admin...
|
4.8 Medium | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-7171
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter:
* CVE-2026-7171: parameter 'Apellido 1' in the endpoint '/administra...
|
4.8 Medium | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-7170
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter:
* CVE-2026-7170: parameter 'vendor_store_name' in the endpoint '/adm...
|
4.8 Medium | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-101037
A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. Affected is the function parse_advertisement_frame of the component devdiscover Service. The manipulation r...
|
9.9 Critical | — | 0,46% | 28 Sep 2026 |
|
CVE-2026-101036
A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts....
|
5.3 Medium | — | 0,17% | 28 Sep 2026 |
|
CVE-2026-101035
A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library src/lib/nas/encode.cpp of the component nr-gnb. Exec...
|
5.3 Medium | — | 0,54% | 28 Sep 2026 |
|
CVE-2026-101018
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the file dayrui/App/Member/Controllers/Admin/Home.php of...
|
4.7 Medium | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-95104
Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition.
|
7.5 High | — | 0,36% | 28 Sep 2026 |
|
CVE-2026-94287
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaust...
|
5.5 Medium | — | 0,10% | 28 Sep 2026 |
|
CVE-2026-94286
An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
|
7.1 High | — | 0,19% | 28 Sep 2026 |
|
CVE-2026-94285
An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.
|
5.1 Medium | — | 0,11% | 28 Sep 2026 |
|
CVE-2026-94284
An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clien...
|
5.5 Medium | — | 0,10% | 28 Sep 2026 |
|
CVE-2026-94283
An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X cli...
|
6.5 Medium | — | 0,20% | 28 Sep 2026 |
|
CVE-2026-94282
An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.
|
5.6 Medium | — | 0,13% | 28 Sep 2026 |
|
CVE-2026-86530
BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execu...
|
7.2 High | — | 0,36% | 28 Sep 2026 |
|
CVE-2026-86507
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session o...
|
6.1 Medium | — | 0,40% | 28 Sep 2026 |
|
CVE-2026-85134
Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web...
|
8.8 High | — | 0,27% | 28 Sep 2026 |
|
CVE-2026-82969
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow M...
|
5.4 Medium | — | 0,15% | 28 Sep 2026 |
|
CVE-2026-82915
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Managem...
|
6.5 Medium | — | 0,30% | 28 Sep 2026 |
|
CVE-2026-101017
A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy...
|
6.5 Medium | — | 0,32% | 28 Sep 2026 |
|
CVE-2026-101016
A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendmarc/opendma...
|
6.5 Medium | — | 0,32% | 28 Sep 2026 |
|
CVE-2026-101015
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain H...
|
7.3 High | — | 0,29% | 28 Sep 2026 |
|
CVE-2026-101014
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopen...
|
7.3 High | — | 0,31% | 28 Sep 2026 |
|
CVE-2026-91206
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scrip...
|
6.1 Medium | — | 0,40% | 28 Sep 2026 |
|
CVE-2026-91204
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment contain...
|
6.1 Medium | — | 0,40% | 28 Sep 2026 |
|
CVE-2026-82546
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted c...
|
6.1 Medium | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-82387
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to store active content...
|
5.4 Medium | — | 0,18% | 28 Sep 2026 |
|
CVE-2026-82386
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal...
|
7.7 High | — | 0,29% | 28 Sep 2026 |
|
CVE-2026-82385
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roll...
|
6.5 Medium | — | 0,28% | 28 Sep 2026 |
|
CVE-2026-82384
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-...
|
9.8 Critical | — | 0,77% | 28 Sep 2026 |
|
CVE-2026-82383
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (th...
|
8.2 High | — | 0,49% | 28 Sep 2026 |
|
CVE-2026-82382
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scrip...
|
6.1 Medium | — | 0,25% | 28 Sep 2026 |
|
CVE-2026-82381
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store craft...
|
5.4 Medium | — | 0,18% | 28 Sep 2026 |