Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-86609
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it ba...
|
8.8 High | — | 0,28% | 27 Sep 2026 |
|
CVE-2026-85002
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the...
|
6.8 Medium | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-84069
The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a...
|
5.3 Medium | — | 0,26% | 27 Sep 2026 |
|
CVE-2026-82841
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have an...
|
5.3 Medium | — | 0,19% | 27 Sep 2026 |
|
CVE-2026-81655
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a confi...
|
7.5 High | — | 0,23% | 27 Sep 2026 |
|
CVE-2026-100746
A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitH...
|
7.3 High | — | 0,50% | 27 Sep 2026 |
|
CVE-2026-100865
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can e...
|
8.8 High | — | 0,32% | 27 Sep 2026 |
|
CVE-2026-100864
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute...
|
8.8 High | — | 0,69% | 27 Sep 2026 |
|
CVE-2026-100863
Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91. First, the LLM image...
|
5.0 Medium | — | 0,25% | 27 Sep 2026 |
|
CVE-2026-100862
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-aut...
|
4.9 Medium | — | 0,19% | 27 Sep 2026 |
|
CVE-2026-100861
heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections....
|
5.0 Medium | — | 0,18% | 27 Sep 2026 |
|
CVE-2026-100860
heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py)...
|
5.5 Medium | — | 0,11% | 27 Sep 2026 |
|
CVE-2026-100859
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to...
|
6.5 Medium | — | 0,25% | 27 Sep 2026 |
|
CVE-2026-100858
heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken...
|
6.8 Medium | — | 0,27% | 27 Sep 2026 |
|
CVE-2026-100857
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequenc...
|
8.0 High | — | 0,34% | 27 Sep 2026 |
|
CVE-2026-100856
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to...
|
8.8 High | — | 0,37% | 27 Sep 2026 |
|
CVE-2026-100855
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to...
|
6.5 Medium | — | 0,21% | 27 Sep 2026 |
|
CVE-2026-100854
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than...
|
6.3 Medium | — | 0,16% | 27 Sep 2026 |
|
CVE-2026-100853
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files...
|
5.9 Medium | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-100852
AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in pro...
|
8.8 High | — | 3,7% | 27 Sep 2026 |
|
CVE-2026-100851
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View St...
|
7.6 High | — | 0,21% | 27 Sep 2026 |
|
CVE-2026-100850
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/QueueBuilde...
|
7.7 High | — | 0,22% | 27 Sep 2026 |
|
CVE-2026-100849
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (backend/src/Web...
|
7.1 High | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-100848
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities\Urls::pars...
|
7.1 High | — | 0,18% | 27 Sep 2026 |
|
CVE-2026-100847
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expr...
|
7.5 High | — | 0,26% | 27 Sep 2026 |
|
CVE-2026-100846
project-monai monai
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file...
|
8.8 High | — | 0,29% | 27 Sep 2026 |
|
CVE-2026-100845
project-monai monai
MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy...
|
7.8 High | — | 0,14% | 27 Sep 2026 |
|
CVE-2026-100844
project-monai monai
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML c...
|
7.8 High | — | 0,77% | 27 Sep 2026 |
|
CVE-2026-100843
project-monai monai
MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3ds...
|
7.8 High | — | 0,20% | 27 Sep 2026 |
|
CVE-2026-100842
project-monai monai
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a help...
|
8.8 High | — | 0,15% | 27 Sep 2026 |
|
CVE-2026-100841
project-monai monai
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (...
|
7.8 High | — | 0,13% | 27 Sep 2026 |
|
CVE-2026-100840
project-monai monai
MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables with...
|
7.8 High | — | 0,22% | 27 Sep 2026 |
|
CVE-2026-100839
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack ("Ba...
|
8.4 High | — | 0,15% | 27 Sep 2026 |
|
CVE-2026-100838
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the Copy...
|
8.1 High | — | 0,22% | 27 Sep 2026 |
|
CVE-2026-100837
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a s...
|
3.7 Low | — | 0,21% | 27 Sep 2026 |
|
CVE-2026-100836
Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded cipherte...
|
4.3 Medium | — | 0,15% | 27 Sep 2026 |
|
CVE-2026-100835
Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected...
|
7.4 High | — | 0,22% | 27 Sep 2026 |
|
CVE-2026-100834
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFi...
|
5.9 Medium | — | 0,32% | 27 Sep 2026 |
|
CVE-2026-100833
Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata...
|
9.6 Critical | — | 0,23% | 27 Sep 2026 |
|
CVE-2026-100745
A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Ha...
|
6.3 Medium | — | 0,31% | 27 Sep 2026 |
|
CVE-2026-100744
A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the componen...
|
7.3 High | — | 0,45% | 27 Sep 2026 |
|
CVE-2026-100725
http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies)...
|
6.5 Medium | — | 0,24% | 27 Sep 2026 |
|
CVE-2026-100724
http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() an...
|
5.4 Medium | — | 0,34% | 27 Sep 2026 |
|
CVE-2026-100723
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin mo...
|
7.5 High | — | 0,32% | 27 Sep 2026 |
|
CVE-2026-100722
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled()...
|
6.8 Medium | — | 0,26% | 27 Sep 2026 |
|
CVE-2026-100721
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `con...
|
9.0 Critical | — | 0,40% | 27 Sep 2026 |
|
CVE-2025-71426
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recovering party....
|
7.1 High | — | 0,14% | 27 Sep 2026 |
|
CVE-2025-71425
Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LE...
|
7.3 High | — | 0,19% | 27 Sep 2026 |
|
CVE-2025-71424
Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile (co...
|
3.5 Low | — | 0,16% | 27 Sep 2026 |
|
CVE-2025-71423
Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which conta...
|
7.3 High | — | 0,21% | 27 Sep 2026 |