Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-88776
citrix netscaler application delivery controller, citrix netscaler gateway
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14....
|
9.8 Critical | — | 0,38% | 27 Sep 2026 |
|
CVE-2026-88775
citrix netscaler application delivery controller, citrix netscaler gateway
Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS,...
|
9.8 Critical | — | 0,38% | 27 Sep 2026 |
|
CVE-2026-88774
citrix netscaler application delivery controller, citrix netscaler gateway
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1...
|
7.2 High | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-88773
Advisory
citrix netscaler application delivery controller, citrix netscaler gateway
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects A...
|
10.0 Critical | — | 0,36% | 27 Sep 2026 |
|
CVE-2026-88772
Advisory
citrix netscaler application delivery controller, citrix netscaler gateway
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1...
|
8.1 High | KEV | 1,3% | 27 Sep 2026 |
|
CVE-2026-88771
Advisory
citrix netscaler application delivery controller, citrix netscaler gateway
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-7...
|
9.8 Critical | KEV | 1,1% | 27 Sep 2026 |
|
CVE-2026-101050
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote...
|
6.5 Medium | — | 0,30% | 27 Sep 2026 |
|
CVE-2026-101049
Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can sen...
|
6.5 Medium | — | 0,30% | 27 Sep 2026 |
|
CVE-2026-101042
Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Google Play G...
|
6.4 Medium | — | 0,21% | 27 Sep 2026 |
|
CVE-2026-101041
The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition in the con...
|
6.3 Medium | — | 0,23% | 27 Sep 2026 |
|
CVE-2026-101033
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate categor...
|
4.3 Medium | — | 0,22% | 27 Sep 2026 |
|
CVE-2026-101032
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through craf...
|
7.0 High | — | 0,15% | 27 Sep 2026 |
|
CVE-2026-100872
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gatewa...
|
7.5 High | — | 0,18% | 27 Sep 2026 |
|
CVE-2026-100871
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints....
|
8.8 High | — | 0,31% | 27 Sep 2026 |
|
CVE-2026-100870
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing un...
|
8.8 High | — | 0,31% | 27 Sep 2026 |
|
CVE-2026-100869
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Atta...
|
5.9 Medium | — | 0,26% | 27 Sep 2026 |
|
CVE-2026-100868
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjac...
|
6.3 Medium | — | 0,26% | 27 Sep 2026 |
|
CVE-2026-100867
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANS...
|
3.3 Low | — | 0,12% | 27 Sep 2026 |
|
CVE-2026-100866
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attac...
|
3.3 Low | — | 0,13% | 27 Sep 2026 |
|
CVE-2026-97165
Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back”...
|
5.3 Medium | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-97164
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the `images` parameter of the `c...
|
7.0 High | — | 0,31% | 27 Sep 2026 |
|
CVE-2026-100749
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than...
|
5.1 Medium | — | 0,15% | 27 Sep 2026 |
|
CVE-2026-100748
Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
|
6.9 Medium | — | 0,15% | 27 Sep 2026 |
|
CVE-2026-100747
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an...
|
5.1 Medium | — | 0,15% | 27 Sep 2026 |
|
CVE-2026-94417
wolfssl
When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that car...
|
5.3 Medium | — | 0,15% | 27 Sep 2026 |
|
CVE-2026-93304
wolfssl
A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client install...
|
3.7 Low | — | 0,15% | 27 Sep 2026 |
|
CVE-2026-93302
wolfssl
MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and...
|
8.2 High | — | 0,20% | 27 Sep 2026 |
|
CVE-2026-89136
When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malic...
|
8.3 High | — | 0,55% | 27 Sep 2026 |
|
CVE-2026-89135
wolfssl
A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consum...
|
6.5 Medium | — | 0,16% | 27 Sep 2026 |
|
CVE-2026-89134
wolfssl
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallb...
|
9.1 Critical | — | 0,16% | 27 Sep 2026 |
|
CVE-2026-89133
wolfssl
wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an...
|
5.3 Medium | — | 0,12% | 27 Sep 2026 |
|
CVE-2026-89102
wolfssl
In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. Wh...
|
6.5 Medium | — | 0,18% | 27 Sep 2026 |
|
CVE-2026-15442
wolfssl
In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free...
|
5.3 Medium | — | 0,30% | 27 Sep 2026 |
|
CVE-2026-94419
wolfssl
Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index, hash(sessionID)} into the proc...
|
5.4 Medium | — | 0,10% | 27 Sep 2026 |
|
CVE-2026-94418
wolfssl
Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges the two resul...
|
7.5 High | — | 0,09% | 27 Sep 2026 |
|
CVE-2026-100741
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated at...
|
9.8 Critical | — | 1,7% | 27 Sep 2026 |
|
CVE-2026-97319
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could all...
|
6.8 Medium | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-97227
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a no...
|
5.9 Medium | — | 0,19% | 27 Sep 2026 |
|
CVE-2026-96899
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing...
|
6.8 Medium | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-96897
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing u...
|
5.3 Medium | — | 0,18% | 27 Sep 2026 |
|
CVE-2026-96896
The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users wi...
|
7.2 High | — | 0,39% | 27 Sep 2026 |
|
CVE-2026-96895
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the...
|
6.8 Medium | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-92995
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the...
|
5.3 Medium | — | 0,21% | 27 Sep 2026 |
|
CVE-2026-92436
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifi...
|
5.3 Medium | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-89006
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contribut...
|
6.8 Medium | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-89003
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing...
|
4.1 Medium | — | 0,18% | 27 Sep 2026 |
|
CVE-2026-89001
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to...
|
4.9 Medium | — | 0,19% | 27 Sep 2026 |
|
CVE-2026-89000
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching...
|
4.1 Medium | — | 0,18% | 27 Sep 2026 |
|
CVE-2026-86841
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a p...
|
4.7 Medium | — | 0,19% | 27 Sep 2026 |
|
CVE-2026-86839
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role A...
|
3.8 Low | — | 0,15% | 27 Sep 2026 |