Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-48540
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users...
|
5.4 Medium | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-97323
A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/jav...
|
6.3 Medium | — | 0,40% | 24 Sep 2026 |
|
CVE-2026-97322
A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yu...
|
4.3 Medium | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-97321
A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yu...
|
6.3 Medium | — | 0,23% | 24 Sep 2026 |
|
CVE-2026-97320
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowl...
|
6.3 Medium | — | 0,20% | 24 Sep 2026 |
|
CVE-2026-96749
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unus...
|
8.4 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-96748
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places...
|
6.5 Medium | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-96747
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path...
|
5.0 Medium | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-89325
An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SY...
|
7.8 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-86860
ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user...
|
9.3 Critical | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-86859
ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an una...
|
8.7 High | — | 0,29% | 24 Sep 2026 |
|
CVE-2026-86858
ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated...
|
8.7 High | — | 0,27% | 24 Sep 2026 |
|
CVE-2026-86857
ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an aut...
|
8.4 High | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-85738
TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition add...
|
6.3 Medium | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-82371
Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative swi...
|
8.5 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-82157
Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent net...
|
8.3 High | — | 0,12% | 24 Sep 2026 |
|
CVE-2026-81473
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentiall...
|
8.1 High | — | 0,09% | 24 Sep 2026 |
|
CVE-2026-81455
Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with r...
|
8.6 High | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-77321
TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requi...
|
4.3 Medium | — | 0,20% | 24 Sep 2026 |
|
CVE-2026-77320
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through G...
|
5.3 Medium | — | 0,23% | 24 Sep 2026 |
|
CVE-2026-77294
TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the L...
|
8.1 High | — | 0,31% | 24 Sep 2026 |
|
CVE-2026-77293
TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against...
|
7.1 High | — | 0,38% | 24 Sep 2026 |
|
CVE-2026-65827
Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload...
|
6.5 Medium | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-62286
Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists...
|
4.3 Medium | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-61825
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vuln...
|
8.7 High | — | 0,22% | 24 Sep 2026 |
|
CVE-2026-61823
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vuln...
|
7.3 High | — | 0,21% | 24 Sep 2026 |
|
CVE-2026-57440
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing ser...
|
7.5 High | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-56792
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentiall...
|
4.4 Medium | — | 0,09% | 24 Sep 2026 |
|
CVE-2026-52853
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an...
|
5.2 Medium | — | 0,21% | 24 Sep 2026 |
|
CVE-2026-52850
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call t...
|
4.3 Medium | — | 0,19% | 24 Sep 2026 |
|
CVE-2026-48073
Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can em...
|
4.3 Medium | — | 0,19% | 24 Sep 2026 |
|
CVE-2026-48072
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path...
|
5.3 Medium | — | 0,33% | 24 Sep 2026 |
|
CVE-2026-48070
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later r...
|
7.1 High | — | 0,37% | 24 Sep 2026 |
|
CVE-2026-13249
An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.01004...
|
9.8 Critical | — | 0,57% | 24 Sep 2026 |
|
CVE-2026-13248
An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell P...
|
8.8 High | — | 0,44% | 24 Sep 2026 |
|
CVE-2026-13016
ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in cer...
|
9.3 Critical | — | 0,27% | 24 Sep 2026 |
|
CVE-2026-97233
A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media File...
|
3.5 Low | — | 0,19% | 24 Sep 2026 |
|
CVE-2026-97232
A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function get_file_content/save_file_content/move_files/start_stre...
|
6.3 Medium | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-95985
The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a u...
|
8.8 High | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-93405
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Ma...
|
6.1 Medium | — | 0,22% | 24 Sep 2026 |
|
CVE-2026-91121
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts w...
|
5.0 Medium | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-91120
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be repar...
|
5.4 Medium | — | 0,20% | 24 Sep 2026 |
|
CVE-2026-91119
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolat...
|
6.4 Medium | — | 0,20% | 24 Sep 2026 |
|
CVE-2026-85057
ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without...
|
8.7 High | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-85056
ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that...
|
8.2 High | — | 0,29% | 24 Sep 2026 |
|
CVE-2026-81508
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads...
|
4.3 Medium | — | 0,21% | 24 Sep 2026 |
|
CVE-2026-71540
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framewor...
|
7.5 High | — | 0,35% | 24 Sep 2026 |
|
CVE-2026-63645
OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the comple...
|
7.5 High | — | 0,33% | 24 Sep 2026 |
|
CVE-2026-61816
zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting...
|
7.5 High | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-61815
zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to...
|
7.2 High | — | 0,18% | 24 Sep 2026 |