Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-56732
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements...
|
5.3 Medium | — | 0,20% | 25 Sep 2026 |
|
CVE-2026-56731
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScr...
|
8.4 High | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-56730
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to...
|
2.1 Low | — | 0,35% | 25 Sep 2026 |
|
CVE-2026-56728
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated...
|
5.3 Medium | — | 0,33% | 25 Sep 2026 |
|
CVE-2026-56727
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verifica...
|
7.1 High | — | 0,25% | 25 Sep 2026 |
|
CVE-2026-56726
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authe...
|
5.1 Medium | — | 0,34% | 25 Sep 2026 |
|
CVE-2026-56725
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check blocks a Z...
|
8.7 High | — | 0,41% | 25 Sep 2026 |
|
CVE-2026-97879
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component a...
|
5.3 Medium | — | 0,65% | 25 Sep 2026 |
|
CVE-2026-97878
A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Su...
|
7.3 High | — | 0,63% | 25 Sep 2026 |
|
CVE-2026-97877
A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml of the com...
|
7.3 High | — | 0,45% | 25 Sep 2026 |
|
CVE-2026-97871
A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the c...
|
7.3 High | — | 0,52% | 25 Sep 2026 |
|
CVE-2026-95835
Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text...
|
5.6 Medium | — | 0,10% | 25 Sep 2026 |
|
CVE-2026-95834
Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to...
|
4.6 Medium | — | 0,13% | 25 Sep 2026 |
|
CVE-2026-94445
A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem.
Disjointly, one of the three poss...
|
8.8 High | — | 0,36% | 25 Sep 2026 |
|
CVE-2026-93365
Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of pri...
|
6.5 Medium | — | 0,21% | 25 Sep 2026 |
|
CVE-2026-93364
Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for admi...
|
4.3 Medium | — | 0,19% | 25 Sep 2026 |
|
CVE-2026-93363
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-lev...
|
4.3 Medium | — | 0,18% | 25 Sep 2026 |
|
CVE-2026-91837
A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting...
|
7.8 High | — | 0,14% | 25 Sep 2026 |
|
CVE-2026-89032
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' ca...
|
7.7 High | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-80432
Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the co...
|
6.0 Medium | — | 0,12% | 25 Sep 2026 |
|
CVE-2026-67421
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reaso...
|
6.8 Medium | — | 0,28% | 25 Sep 2026 |
|
CVE-2026-67420
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags...
|
6.5 Medium | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-67419
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segme...
|
6.5 Medium | — | 0,37% | 25 Sep 2026 |
|
CVE-2026-67415
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into no...
|
4.9 Medium | — | 0,38% | 25 Sep 2026 |
|
CVE-2026-67413
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic exchange ac...
|
6.5 Medium | — | 0,42% | 25 Sep 2026 |
|
CVE-2026-67412
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allo...
|
7.1 High | — | 0,26% | 25 Sep 2026 |
|
CVE-2026-67411
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Prot...
|
7.1 High | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-67410
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth...
|
7.1 High | — | 0,35% | 25 Sep 2026 |
|
CVE-2026-67409
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Dest...
|
6.5 Medium | — | 0,42% | 25 Sep 2026 |
|
CVE-2026-67408
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node...
|
6.5 Medium | — | 0,45% | 25 Sep 2026 |
|
CVE-2026-67407
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape...
|
7.1 High | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-67406
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave u...
|
6.5 Medium | — | 0,29% | 25 Sep 2026 |
|
CVE-2026-67242
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1...
|
5.4 Medium | — | 0,35% | 25 Sep 2026 |
|
CVE-2026-67241
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /excha...
|
6.5 Medium | — | 0,35% | 25 Sep 2026 |
|
CVE-2026-67239
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-manage...
|
5.4 Medium | — | 0,16% | 25 Sep 2026 |
|
CVE-2026-67237
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token coo...
|
7.5 High | — | 0,48% | 25 Sep 2026 |
|
CVE-2026-67234
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_...
|
2.3 Low | — | 0,56% | 25 Sep 2026 |
|
CVE-2026-67230
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_size nor lo...
|
6.3 Medium | — | 0,47% | 25 Sep 2026 |
|
CVE-2026-67227
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resourceexists/2...
|
5.9 Medium | — | 0,29% | 25 Sep 2026 |
|
CVE-2026-67226
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdat...
|
6.9 Medium | — | 0,35% | 25 Sep 2026 |
|
CVE-2026-67225
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tu...
|
6.3 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-67223
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versio...
|
7.1 High | — | 0,36% | 25 Sep 2026 |
|
CVE-2026-67222
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied list_to_atom/1 to every colon-delimited token in...
|
6.5 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-66078
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name ref...
|
5.5 Medium | — | 0,38% | 25 Sep 2026 |
|
CVE-2026-66073
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/que...
|
6.5 Medium | — | 0,41% | 25 Sep 2026 |
|
CVE-2026-66071
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extracts...
|
6.5 Medium | — | 0,48% | 25 Sep 2026 |
|
CVE-2026-61837
broadcom rabbitmq server
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any au...
|
5.3 Medium | — | 0,26% | 25 Sep 2026 |
|
CVE-2026-56729
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledg...
|
2.1 Low | — | 0,38% | 25 Sep 2026 |
|
CVE-2026-56724
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been...
|
7.1 High | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-56723
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the artic...
|
7.1 High | — | 0,27% | 25 Sep 2026 |