Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-97063
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending th...
|
9.1 Critical | — | 0,29% | 25 Sep 2026 |
|
CVE-2026-97060
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verificati...
|
7.2 High | — | 0,31% | 25 Sep 2026 |
|
CVE-2026-84465
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does n...
|
7.1 High | — | 0,12% | 25 Sep 2026 |
|
CVE-2026-84464
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system...
|
7.1 High | — | 0,29% | 25 Sep 2026 |
|
CVE-2026-84463
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a...
|
6.3 Medium | — | 0,15% | 25 Sep 2026 |
|
CVE-2026-84461
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any accou...
|
6.9 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-84460
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive t...
|
5.3 Medium | — | 0,26% | 25 Sep 2026 |
|
CVE-2026-84458
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an...
|
9.1 Critical | — | 0,36% | 25 Sep 2026 |
|
CVE-2026-63216
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents withi...
|
5.3 Medium | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-63208
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authenticati...
|
5.1 Medium | — | 0,31% | 25 Sep 2026 |
|
CVE-2026-63207
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleart...
|
6.9 Medium | — | 0,17% | 25 Sep 2026 |
|
CVE-2026-63206
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views...
|
5.3 Medium | — | 0,28% | 25 Sep 2026 |
|
CVE-2026-63205
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images reference...
|
5.1 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-63204
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run...
|
2.3 Low | — | 0,29% | 25 Sep 2026 |
|
CVE-2026-63006
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanit...
|
5.3 Medium | — | 0,48% | 25 Sep 2026 |
|
CVE-2026-61855
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can ma...
|
5.3 Medium | — | 0,21% | 25 Sep 2026 |
|
CVE-2026-55217
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge b...
|
5.3 Medium | — | 0,31% | 25 Sep 2026 |
|
CVE-2026-55214
GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any use...
|
8.5 High | — | 0,28% | 25 Sep 2026 |
|
CVE-2026-53629
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab...
|
7.1 High | — | 1,0% | 25 Sep 2026 |
|
CVE-2026-53628
GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2F...
|
5.9 Medium | — | 0,45% | 25 Sep 2026 |
|
CVE-2026-53627
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operatio...
|
6.0 Medium | — | 0,31% | 25 Sep 2026 |
|
CVE-2026-53626
GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confi...
|
7.1 High | — | 0,30% | 25 Sep 2026 |
|
CVE-2026-53625
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change anot...
|
7.5 High | — | 0,57% | 25 Sep 2026 |
|
CVE-2026-53610
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup wi...
|
7.5 High | — | 0,39% | 25 Sep 2026 |
|
CVE-2026-49470
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submission...
|
7.7 High | — | 0,36% | 25 Sep 2026 |
|
CVE-2026-49469
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through t...
|
4.6 Medium | — | 0,40% | 25 Sep 2026 |
|
CVE-2026-48482
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifie...
|
9.4 Critical | — | 0,34% | 25 Sep 2026 |
|
CVE-2026-47679
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the pro...
|
8.5 High | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-45801
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode....
|
5.3 Medium | — | 0,31% | 25 Sep 2026 |
|
CVE-2026-100306
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can s...
|
5.3 Medium | — | 0,39% | 25 Sep 2026 |
|
CVE-2026-100305
TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated attackers who...
|
4.3 Medium | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-100304
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated u...
|
5.3 Medium | — | 0,35% | 25 Sep 2026 |
|
CVE-2026-100303
TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can a...
|
5.4 Medium | — | 0,28% | 25 Sep 2026 |
|
CVE-2026-100192
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticat...
|
6.5 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-97886
A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown fun...
|
6.3 Medium | — | 0,30% | 25 Sep 2026 |
|
CVE-2026-97885
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty...
|
7.3 High | — | 0,26% | 25 Sep 2026 |
|
CVE-2026-97884
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updat...
|
6.3 Medium | — | 0,19% | 25 Sep 2026 |
|
CVE-2026-97883
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of...
|
7.3 High | — | 0,31% | 25 Sep 2026 |
|
CVE-2026-97882
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of t...
|
7.3 High | — | 0,51% | 25 Sep 2026 |
|
CVE-2026-93366
Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belongin...
|
5.4 Medium | — | 0,19% | 25 Sep 2026 |
|
CVE-2026-91841
A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into t...
|
7.8 High | — | 0,19% | 25 Sep 2026 |
|
CVE-2026-91840
A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN...
|
7.8 High | — | 0,19% | 25 Sep 2026 |
|
CVE-2026-91839
A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF)...
|
7.8 High | — | 0,20% | 25 Sep 2026 |
|
CVE-2026-91838
A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters,...
|
7.8 High | — | 0,10% | 25 Sep 2026 |
|
CVE-2026-84462
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypassed by ent...
|
8.6 High | — | 0,28% | 25 Sep 2026 |
|
CVE-2026-65828
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store reco...
|
2.3 Low | — | 0,20% | 25 Sep 2026 |
|
CVE-2026-61525
Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is suscepti...
|
8.8 High | — | 0,36% | 25 Sep 2026 |
|
CVE-2026-56735
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer (HtmlSanitizer::Strict) blocks external URLs in to...
|
5.3 Medium | — | 0,42% | 25 Sep 2026 |
|
CVE-2026-56734
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the extern...
|
5.3 Medium | — | 0,40% | 25 Sep 2026 |
|
CVE-2026-56733
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization...
|
8.7 High | — | 0,27% | 25 Sep 2026 |