Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-97577
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
rockchip_vpu981_av1_dec_...
|
7.8 High | — | 0,16% | 25 Sep 2026 |
|
CVE-2026-97576
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-ctrls: validate HEVC tile counts
The stateless HEVC decoders read num_tile_columns_minus...
|
7.8 High | — | 0,16% | 25 Sep 2026 |
|
CVE-2026-97575
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-ctrls: validate AV1 tile counts
The stateless AV1 decoders use tile_info.tile_cols and t...
|
7.8 High | — | 0,16% | 25 Sep 2026 |
|
CVE-2026-97573
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
bnxt_rx_ring_reset() frees the rin...
|
8.1 High | — | 0,60% | 25 Sep 2026 |
|
CVE-2026-97570
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Bound SW TPA IDs to prevent crashes
FW supports up to 1024 concurrent TPAs, so the FW TPA I...
|
8.1 High | — | 0,44% | 25 Sep 2026 |
|
CVE-2026-97562
In the Linux kernel, the following vulnerability has been resolved:
smb: client: pin DFS superblock in iterator callback
tcon_super_cb() stores a raw superblock pointer...
|
7.5 High | — | 0,41% | 25 Sep 2026 |
|
CVE-2026-97557
In the Linux kernel, the following vulnerability has been resolved:
smb: client: avoid leaking refcount in cifs_queue_oplock_break()
cifs_queue_oplock_break() unconditi...
|
7.5 High | — | 0,66% | 25 Sep 2026 |
|
CVE-2026-97555
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix heap overflow in DACL owner/group rewrite
When id_mode_to_cifs_acl rewrites an exis...
|
8.8 High | — | 0,52% | 25 Sep 2026 |
|
CVE-2026-97548
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions
The _maxlevels_ondisk functions are u...
|
7.8 High | — | 0,17% | 25 Sep 2026 |
|
CVE-2026-97536
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
The response queue MSI-X handler q...
|
7.5 High | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-97531
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Skip vport under deletion in report ID acquisition
qla24xx_report_id_acquisition() fo...
|
7.5 High | — | 0,28% | 25 Sep 2026 |
|
CVE-2026-97528
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
qla_nvme_xmt_ls_rsp() obtains...
|
8.8 High | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-97527
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
The fcport->unsol_ctx_head list...
|
8.8 High | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-97525
In the Linux kernel, the following vulnerability has been resolved:
x86/mm/pat: Allocate split page tables as kernel page tables
A PTE is allocated directly without goi...
|
8.2 High | — | 0,17% | 25 Sep 2026 |
|
CVE-2026-97524
In the Linux kernel, the following vulnerability has been resolved:
mptcp: avoid unneeded actions on subflow reset
Once in a blue moon, the mptcp receive path can recur...
|
7.5 High | — | 0,69% | 25 Sep 2026 |
|
CVE-2026-97523
In the Linux kernel, the following vulnerability has been resolved:
mptcp: close race between scheduler and state change
The mptcp scheduler may race with subflow socke...
|
7.5 High | — | 0,67% | 25 Sep 2026 |
|
CVE-2026-97228
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager...
|
2.7 Low | — | 0,25% | 25 Sep 2026 |
|
CVE-2026-27867
An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware ver...
|
4.8 Medium | — | 0,37% | 25 Sep 2026 |
|
CVE-2026-97898
Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door...
|
8.4 High | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-92106
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize ro...
|
2.3 Low | — | 0,39% | 25 Sep 2026 |
|
CVE-2026-97863
The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The mod...
|
6.3 Medium | — | 0,32% | 25 Sep 2026 |
|
CVE-2026-92573
apache qpid broker-j
Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JS...
|
6.5 Medium | — | 0,41% | 25 Sep 2026 |
|
CVE-2026-92564
apache qpid broker-j
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qpid Broker-J...
|
7.5 High | — | 0,48% | 25 Sep 2026 |
|
CVE-2026-92560
apache qpid broker-j
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpi...
|
7.5 High | — | 0,48% | 25 Sep 2026 |
|
CVE-2026-92550
apache qpid broker-j
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpi...
|
7.5 High | — | 0,48% | 25 Sep 2026 |
|
CVE-2026-88848
The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan...
|
4.2 Medium | — | 0,12% | 25 Sep 2026 |
|
CVE-2026-86837
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a...
|
5.3 Medium | — | 0,18% | 25 Sep 2026 |
|
CVE-2026-80514
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate l...
|
5.3 Medium | — | 0,16% | 25 Sep 2026 |
|
CVE-2026-6088
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/confi...
|
5.1 Medium | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-6087
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/confi...
|
5.1 Medium | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-6086
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/confi...
|
5.1 Medium | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-6085
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/confi...
|
5.1 Medium | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-6084
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/confi...
|
5.1 Medium | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-6083
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '
/inventory/conf...
|
5.1 Medium | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-6082
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/confi...
|
5.1 Medium | — | 0,23% | 25 Sep 2026 |
|
CVE-2026-96752
The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up...
|
7.2 High | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-96568
The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and includ...
|
7.2 High | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-96448
A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks...
|
6.6 Medium | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-95866
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avata...
|
7.2 High | — | 0,26% | 25 Sep 2026 |
|
CVE-2026-95864
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insuff...
|
7.2 High | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-94573
The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2...
|
7.2 High | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-93901
The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlogCredential...
|
7.3 High | — | 0,35% | 25 Sep 2026 |
|
CVE-2026-93747
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due t...
|
6.4 Medium | — | 0,20% | 25 Sep 2026 |
|
CVE-2026-93656
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avata...
|
6.4 Medium | — | 0,20% | 25 Sep 2026 |
|
CVE-2026-93654
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter in all...
|
7.2 High | — | 0,24% | 25 Sep 2026 |
|
CVE-2026-92713
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload...
|
8.1 High | — | 0,27% | 25 Sep 2026 |
|
CVE-2026-92609
apache qpid broker-j
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session ident...
|
9.8 Critical | — | 0,44% | 25 Sep 2026 |
|
CVE-2026-92608
apache qpid broker-j
Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 cons...
|
7.5 High | — | 0,47% | 25 Sep 2026 |
|
CVE-2026-89426
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. Th...
|
8.8 High | — | 0,48% | 25 Sep 2026 |
|
CVE-2026-89406
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and inc...
|
7.5 High | — | 0,39% | 25 Sep 2026 |