Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2025-71422
Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying...
|
5.7 Medium | — | 0,07% | 27 Sep 2026 |
|
CVE-2026-100740
A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. P...
|
9.9 Critical | — | 0,45% | 27 Sep 2026 |
|
CVE-2026-100739
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewr...
|
7.3 High | — | 0,25% | 26 Sep 2026 |
|
CVE-2026-94408
elasticsearch
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
|
4.9 Medium | — | 0,44% | 26 Sep 2026 |
|
CVE-2026-94400
elastic kibana
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
|
6.5 Medium | — | 0,42% | 26 Sep 2026 |
|
CVE-2026-94399
elasticsearch
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
|
6.5 Medium | — | 0,42% | 26 Sep 2026 |
|
CVE-2026-94398
elasticsearch
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
|
6.5 Medium | — | 0,42% | 26 Sep 2026 |
|
CVE-2026-94397
elasticsearch
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
|
6.5 Medium | — | 0,42% | 26 Sep 2026 |
|
CVE-2026-94396
elasticsearch
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
|
6.5 Medium | — | 0,42% | 26 Sep 2026 |
|
CVE-2026-82300
elasticsearch
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
|
6.5 Medium | — | 0,42% | 26 Sep 2026 |
|
CVE-2026-82294
elasticsearch
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
|
6.5 Medium | — | 0,42% | 26 Sep 2026 |
|
CVE-2026-78582
Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An a...
|
6.5 Medium | — | 0,18% | 26 Sep 2026 |
|
CVE-2026-72668
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared a...
|
7.3 High | — | 0,18% | 26 Sep 2026 |
|
CVE-2026-72662
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality N...
|
6.3 Medium | — | 0,17% | 26 Sep 2026 |
|
CVE-2026-82901
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_componen...
|
9.8 Critical | — | 1,1% | 26 Sep 2026 |
|
CVE-2026-85984
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versi...
|
9.8 Critical | — | 0,67% | 26 Sep 2026 |
|
CVE-2026-77203
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the gro...
|
8.8 High | — | 0,33% | 26 Sep 2026 |
|
CVE-2026-97163
Advisory
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
|
10.0 Critical | — | 0,42% | 26 Sep 2026 |
|
CVE-2026-97162
Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
|
8.3 High | — | 0,31% | 26 Sep 2026 |
|
CVE-2026-97161
Advisory
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
|
9.2 Critical | — | 0,42% | 26 Sep 2026 |
|
CVE-2026-97160
Advisory
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
|
9.4 Critical | — | 1,3% | 26 Sep 2026 |
|
CVE-2026-94132
Advisory
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming ema...
|
9.5 Critical | — | 0,55% | 26 Sep 2026 |
|
CVE-2026-94131
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type c...
|
8.3 High | — | 0,26% | 26 Sep 2026 |
|
CVE-2026-94130
Advisory
joomlaboat youtube gallery
Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injection vulnerability in video search functionality and...
|
9.8 Critical | — | 0,42% | 26 Sep 2026 |
|
CVE-2026-100720
Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one o...
|
8.7 High | — | 0,22% | 26 Sep 2026 |
|
CVE-2026-100719
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticate...
|
6.5 Medium | — | 0,24% | 26 Sep 2026 |
|
CVE-2026-100718
Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender fe...
|
7.1 High | — | 0,19% | 26 Sep 2026 |
|
CVE-2026-100717
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query a...
|
9.9 Critical | — | 0,30% | 26 Sep 2026 |
|
CVE-2026-100716
Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the e...
|
9.9 Critical | — | 0,39% | 26 Sep 2026 |
|
CVE-2026-100715
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP...
|
9.6 Critical | — | 0,40% | 26 Sep 2026 |
|
CVE-2026-100714
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_rege...
|
9.1 Critical | — | 0,55% | 26 Sep 2026 |
|
CVE-2026-100713
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::...
|
7.8 High | — | 0,16% | 26 Sep 2026 |
|
CVE-2026-100712
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g. /customer_...
|
6.5 Medium | — | 0,13% | 26 Sep 2026 |
|
CVE-2026-100711
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked ses...
|
7.5 High | — | 0,26% | 26 Sep 2026 |
|
CVE-2026-100710
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::li...
|
4.9 Medium | — | 0,24% | 26 Sep 2026 |
|
CVE-2026-100709
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup...
|
7.5 High | — | 0,29% | 26 Sep 2026 |
|
CVE-2026-100708
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Cert...
|
7.1 High | — | 0,13% | 26 Sep 2026 |
|
CVE-2026-100707
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between va...
|
7.7 High | — | 0,46% | 26 Sep 2026 |
|
CVE-2026-100706
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and cre...
|
9.9 Critical | — | 0,61% | 26 Sep 2026 |
|
CVE-2026-100705
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8,...
|
7.6 High | — | 0,20% | 26 Sep 2026 |
|
CVE-2026-100704
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.image...
|
7.7 High | — | 0,18% | 26 Sep 2026 |
|
CVE-2026-100703
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling lib...
|
7.7 High | — | 0,23% | 26 Sep 2026 |
|
CVE-2026-100702
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attacke...
|
5.9 Medium | — | 0,25% | 26 Sep 2026 |
|
CVE-2026-100701
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS ser...
|
5.9 Medium | — | 0,11% | 26 Sep 2026 |
|
CVE-2026-100700
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. A...
|
7.5 High | — | 0,28% | 26 Sep 2026 |
|
CVE-2026-100699
Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted...
|
5.3 Medium | — | 0,19% | 26 Sep 2026 |
|
CVE-2026-100698
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires...
|
5.8 Medium | — | 0,28% | 26 Sep 2026 |
|
CVE-2026-100697
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authenticatio...
|
8.6 High | — | 0,31% | 26 Sep 2026 |
|
CVE-2026-100696
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.p...
|
5.8 Medium | — | 0,31% | 26 Sep 2026 |
|
CVE-2026-100695
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allo...
|
6.1 Medium | — | 0,28% | 26 Sep 2026 |