Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-93826
In the Linux kernel, the following vulnerability has been resolved:
HID: hidpp: fix potential UAF in hidpp_connect_event()
If input_register_device() fails, we call inp...
|
7.5 High | — | 0,23% | 24 Sep 2026 |
|
CVE-2026-93817
In the Linux kernel, the following vulnerability has been resolved:
perf: Fix addr_filter_ranges lifetime
Lee Jia Jie reported that since event::addr_filter_ranges is u...
|
7.8 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-93816
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate inline dentry name lengths before conversion
Inline dentry conversion copies names ou...
|
7.1 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-93813
In the Linux kernel, the following vulnerability has been resolved:
btrfs: tree-checker: validate INODE_REF's namelen
[BUG]
A crafted btrfs image can trigger the follow...
|
7.8 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-93810
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: Fix double fput
Fix a double fput() in error handling in cachefiles_create_tmpfile().
|
7.0 High | — | 0,12% | 24 Sep 2026 |
|
CVE-2026-93806
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: validate assoc response length before status and IE access
cfg80211_rx_assoc_resp()...
|
8.8 High | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-93801
In the Linux kernel, the following vulnerability has been resolved:
smb/client: zero-initialize stack-allocated cifs_open_info_data
Stack-allocated cifs_open_info_data...
|
7.0 High | — | 0,12% | 24 Sep 2026 |
|
CVE-2026-93799
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: validate sta_id in BA window status notif
BA_WINDOW_STATUS_NOTIFICATION_ID extra...
|
8.8 High | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-93798
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix reloc root cleanup in merge_reloc_roots()
If the root we got has zero root refs in its ro...
|
7.8 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-93796
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: null RX pointers after free
When iwl_pcie_tx_init() fails after RX init, nic in...
|
7.0 High | — | 0,12% | 24 Sep 2026 |
|
CVE-2026-93793
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: validate TX_CMD response layout
TX_CMD parsing uses frame_count to walk status e...
|
8.8 High | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-93790
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
mvmsta->tid_data was indexed by th...
|
8.8 High | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-93787
In the Linux kernel, the following vulnerability has been resolved:
smb: client: bound dirent name against end of SMB response in cifs_filldir
cifs_filldir() copies the...
|
8.1 High | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-93786
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: preserve VFS inherited POSIX ACL mask
The VFS initializes a child's POSIX ACL from the parent...
|
8.1 High | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-93782
In the Linux kernel, the following vulnerability has been resolved:
vhost-scsi: flush backend after device ioctls
vhost-scsi translates guest response descriptors into...
|
7.8 High | — | 0,12% | 24 Sep 2026 |
|
CVE-2026-93545
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
|
6.5 Medium | — | 0,20% | 24 Sep 2026 |
|
CVE-2026-93544
An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.
|
6.5 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-93543
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
|
7.4 High | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-93542
An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.
|
6.5 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-93288
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
sashiko reports: "nf...
|
7.8 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-93287
In the Linux kernel, the following vulnerability has been resolved:
i2c: smbus: reject oversized block transfers in the common path
The SMBus block transfer length data...
|
7.8 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-93284
In the Linux kernel, the following vulnerability has been resolved:
drm/pagemap: dma-unmap pages before handling migration errors
drm_pagemap_migrate_unmap_pages() reli...
|
8.8 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-91161
OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and the GroupGet...
|
6.4 Medium | — | 0,18% | 24 Sep 2026 |
|
CVE-2026-91160
OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that sub...
|
8.2 High | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-91134
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to...
|
5.4 Medium | — | 0,22% | 24 Sep 2026 |
|
CVE-2026-88385
Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNe...
|
6.5 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-91133
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters t...
|
6.5 Medium | — | 0,29% | 24 Sep 2026 |
|
CVE-2026-91132
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could a...
|
4.3 Medium | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-91123
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as...
|
7.2 High | — | 0,29% | 24 Sep 2026 |
|
CVE-2026-91122
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an att...
|
8.7 High | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-88390
An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input containing an overlong token to trigg...
|
7.7 High | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-88383
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function p...
|
6.2 Medium | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-88384
OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set...
|
5.5 Medium | — | 0,19% | 24 Sep 2026 |
|
CVE-2026-88382
hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.
|
7.5 High | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-88378
QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().
|
9.8 Critical | — | 0,45% | 24 Sep 2026 |
|
CVE-2026-88377
Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declare...
|
6.2 Medium | — | 0,12% | 24 Sep 2026 |
|
CVE-2026-88376
Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC a...
|
7.5 High | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-88373
libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the result...
|
7.5 High | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-88372
libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.
|
7.5 High | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-88367
NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing...
|
6.5 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-84302
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appe...
|
4.2 Medium | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-79766
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrato...
|
9.1 Critical | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-79764
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts...
|
7.7 High | — | 0,42% | 24 Sep 2026 |
|
CVE-2026-79763
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POS...
|
5.3 Medium | — | 0,32% | 24 Sep 2026 |
|
CVE-2026-79762
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OI...
|
5.5 Medium | — | 0,08% | 24 Sep 2026 |
|
CVE-2026-63498
snipeitapp snipe-it
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated...
|
5.4 Medium | — | 0,21% | 24 Sep 2026 |
|
CVE-2026-63493
snipeitapp snipe-it
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-...
|
8.1 High | — | 0,27% | 24 Sep 2026 |
|
CVE-2026-62368
snipeitapp snipe-it
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters...
|
8.4 High | — | 0,35% | 24 Sep 2026 |
|
CVE-2026-56744
`@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and `@bsv/wallet-toolbox-mobile` provide client-focused d...
|
8.7 High | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-56738
phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and inserts the...
|
8.5 High | — | 0,26% | 24 Sep 2026 |