Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-91768
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead o...
|
6.5 Medium | — | 0,56% | 25 Sep 2026 |
|
CVE-2026-88003
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges...
|
7.5 High | — | 0,30% | 25 Sep 2026 |
|
CVE-2026-71483
Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_na...
|
8.5 High | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-63432
Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py re...
|
6.5 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-63431
Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allowances_deductions_tab, view_sin...
|
6.5 Medium | — | 0,21% | 25 Sep 2026 |
|
CVE-2026-100502
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with a...
|
5.0 Medium | — | 0,29% | 25 Sep 2026 |
|
CVE-2026-100501
Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated a...
|
6.5 Medium | — | 0,29% | 25 Sep 2026 |
|
CVE-2026-100419
gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory vi...
|
7.0 High | — | 0,15% | 25 Sep 2026 |
|
CVE-2026-100418
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without fi...
|
5.3 Medium | — | 0,34% | 25 Sep 2026 |
|
CVE-2026-100383
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows...
|
4.8 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-100382
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows...
|
10.0 Critical | — | 0,95% | 25 Sep 2026 |
|
CVE-2026-100381
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allow...
|
5.3 Medium | — | 0,33% | 25 Sep 2026 |
|
CVE-2026-96879
Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.
|
6.9 Medium | — | 0,26% | 25 Sep 2026 |
|
CVE-2026-91769
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requi...
|
4.3 Medium | — | 0,14% | 25 Sep 2026 |
|
CVE-2026-91767
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose...
|
6.5 Medium | — | 0,15% | 25 Sep 2026 |
|
CVE-2026-91766
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect t...
|
5.9 Medium | — | 0,34% | 25 Sep 2026 |
|
CVE-2026-91765
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of...
|
7.5 High | — | 0,52% | 25 Sep 2026 |
|
CVE-2026-6103
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF...
|
4.3 Medium | — | 0,17% | 25 Sep 2026 |
|
CVE-2026-57443
SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aethe...
|
7.5 High | — | 0,57% | 25 Sep 2026 |
|
CVE-2026-17545
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appe...
|
6.9 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-10758
Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in...
|
7.5 High | — | 0,33% | 25 Sep 2026 |
|
CVE-2026-100417
RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from t...
|
3.1 Low | — | 0,21% | 25 Sep 2026 |
|
CVE-2026-100391
MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d quer...
|
8.2 High | — | 0,31% | 25 Sep 2026 |
|
CVE-2026-100390
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting ove...
|
7.4 High | — | 0,29% | 25 Sep 2026 |
|
CVE-2026-100389
GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions....
|
8.1 High | — | 0,58% | 25 Sep 2026 |
|
CVE-2026-100388
RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS....
|
5.4 Medium | — | 0,18% | 25 Sep 2026 |
|
CVE-2026-100387
pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adja...
|
8.1 High | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-100380
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cr...
|
5.3 Medium | — | 0,33% | 25 Sep 2026 |
|
CVE-2026-100379
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookie...
|
5.3 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-100378
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs.
This issue a...
|
5.3 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-100377
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation.
This issue affects M...
|
6.9 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-100376
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension al...
|
4.8 Medium | — | 0,30% | 25 Sep 2026 |
|
CVE-2026-100369
CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs and wrapping executable processes. `CliInvoke` ve...
|
8.4 High | — | 0,36% | 25 Sep 2026 |
|
CVE-2025-1218
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL se...
|
3.4 Low | — | 0,18% | 25 Sep 2026 |
|
CVE-2025-14181
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger....
|
6.5 Medium | — | 0,34% | 25 Sep 2026 |
|
CVE-2026-96878
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS.
This issue affect...
|
6.9 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-96877
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS.
This issue affect...
|
6.9 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-96876
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS.
This issue affect...
|
6.9 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-96875
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS.
This issue affects...
|
6.9 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-93682
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap...
|
5.8 Medium | — | 0,35% | 25 Sep 2026 |
|
CVE-2026-5267
Ciena Navigator Network
Control Suite (NCS) contains an information exposure vulnerability in an
event-streaming API that does not properly enforce authentication. An
una...
|
7.5 High | — | 0,36% | 25 Sep 2026 |
|
CVE-2026-100373
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and...
|
4.1 Medium | — | 0,26% | 25 Sep 2026 |
|
CVE-2026-100372
ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by su...
|
7.2 High | — | 1,1% | 25 Sep 2026 |
|
CVE-2026-100368
CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as PowerShell an...
|
8.4 High | — | 0,58% | 25 Sep 2026 |
|
CVE-2026-100310
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A loca...
|
7.0 High | — | 0,14% | 25 Sep 2026 |
|
CVE-2026-100208
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
|
7.5 High | — | 0,35% | 25 Sep 2026 |
|
CVE-2026-97897
A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media...
|
3.5 Low | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-97896
A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/H...
|
3.5 Low | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-97895
A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserControl...
|
6.3 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-97064
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authen...
|
9.1 Critical | — | 0,30% | 25 Sep 2026 |