Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-92289
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticat...
|
9.1 Critical | — | 0,39% | 25 Sep 2026 |
|
CVE-2026-92288
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthent...
|
9.1 Critical | — | 0,37% | 25 Sep 2026 |
|
CVE-2026-85417
Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configurat...
|
6.4 Medium | — | 0,19% | 25 Sep 2026 |
|
CVE-2026-53493
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage...
|
6.9 Medium | — | 0,36% | 25 Sep 2026 |
|
CVE-2026-85082
Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command.
|
8.5 High | — | 0,13% | 25 Sep 2026 |
|
CVE-2026-84283
Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that...
|
6.8 Medium | — | 0,11% | 25 Sep 2026 |
|
CVE-2026-97230
IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.
The generate_certificate runs a Python script...
|
9.8 Critical | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-97636
Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag au...
|
6.5 Medium | — | 0,37% | 24 Sep 2026 |
|
CVE-2026-87722
Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling...
|
8.7 High | — | 0,32% | 24 Sep 2026 |
|
CVE-2026-87721
Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.1...
|
8.7 High | — | 0,32% | 24 Sep 2026 |
|
CVE-2026-87720
Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review vers...
|
7.6 High | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-85491
Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request...
|
8.8 High | — | 0,36% | 24 Sep 2026 |
|
CVE-2026-97368
A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/...
|
6.3 Medium | — | 0,23% | 24 Sep 2026 |
|
CVE-2026-97366
A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of th...
|
6.3 Medium | — | 1,2% | 24 Sep 2026 |
|
CVE-2026-95699
Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data...
|
9.6 Critical | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-93353
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths ou...
|
3.1 Low | — | 0,27% | 24 Sep 2026 |
|
CVE-2026-88388
Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker...
|
7.5 High | — | 0,32% | 24 Sep 2026 |
|
CVE-2026-88387
LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW...
|
5.5 Medium | — | 0,12% | 24 Sep 2026 |
|
CVE-2026-88386
libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to c...
|
5.5 Medium | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-87118
The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with adjacent netw...
|
5.7 Medium | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-84403
The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT c...
|
6.2 Medium | — | 0,12% | 24 Sep 2026 |
|
CVE-2026-82716
The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the support process....
|
4.6 Medium | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-82708
The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with access to the device's WiFi network could submit a cra...
|
6.5 Medium | — | 0,21% | 24 Sep 2026 |
|
CVE-2026-82585
The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on t...
|
6.5 Medium | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-81630
The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprotected conne...
|
8.1 High | — | 0,19% | 24 Sep 2026 |
|
CVE-2026-79959
The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or has physica...
|
6.8 Medium | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-75558
The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker w...
|
5.3 Medium | — | 0,16% | 24 Sep 2026 |
|
CVE-2026-14443
Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system l...
|
8.4 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-14442
An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When schedul...
|
6.9 Medium | — | 0,16% | 24 Sep 2026 |
|
CVE-2026-14441
A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issu...
|
6.9 Medium | — | 0,36% | 24 Sep 2026 |
|
CVE-2026-97365
A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a manipulation o...
|
6.3 Medium | — | 0,35% | 24 Sep 2026 |
|
CVE-2026-97326
A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file cha...
|
7.3 High | — | 0,28% | 24 Sep 2026 |
|
CVE-2026-97325
A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the f...
|
4.3 Medium | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-97324
A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/jav...
|
7.3 High | — | 0,28% | 24 Sep 2026 |
|
CVE-2026-96883
pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute...
|
8.8 High | — | 0,65% | 24 Sep 2026 |
|
CVE-2026-93354
Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over u...
|
8.1 High | — | 0,27% | 24 Sep 2026 |
|
CVE-2026-93291
Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code.
|
9.4 Critical | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-93290
Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data.
|
5.5 Medium | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-93289
The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.
|
7.5 High | — | 0,68% | 24 Sep 2026 |
|
CVE-2026-88956
The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does...
|
6.8 Medium | — | 0,22% | 24 Sep 2026 |
|
CVE-2026-88761
The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are advertised by the product. An unaut...
|
5.3 Medium | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-85496
The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated...
|
8.8 High | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-84399
The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an...
|
8.8 High | — | 0,19% | 24 Sep 2026 |
|
CVE-2026-82566
The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection h...
|
8.8 High | — | 0,28% | 24 Sep 2026 |
|
CVE-2026-82372
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in ap...
|
8.5 High | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-82164
Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with lo...
|
7.1 High | — | 0,09% | 24 Sep 2026 |
|
CVE-2026-77967
The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An un...
|
8.1 High | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-48543
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users...
|
5.4 Medium | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-48542
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users...
|
5.4 Medium | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-48541
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users...
|
5.4 Medium | — | 0,14% | 24 Sep 2026 |