Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-47132
phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search al...
|
5.4 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-26054
SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeM...
|
6.8 Medium | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-97226
A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the...
|
6.3 Medium | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-97225
A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Exe...
|
6.3 Medium | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-96873
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS.
This issue...
|
5.5 Medium | — | 0,27% | 24 Sep 2026 |
|
CVE-2026-96750
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's vie...
|
7.1 High | — | 0,21% | 24 Sep 2026 |
|
CVE-2026-96746
An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the...
|
6.5 Medium | — | 0,37% | 24 Sep 2026 |
|
CVE-2026-96745
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the dr...
|
5.6 Medium | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-96744
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock o...
|
7.1 High | — | 0,29% | 24 Sep 2026 |
|
CVE-2026-93541
An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a
|
6.5 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-93425
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value fr...
|
9.9 Critical | — | 0,62% | 24 Sep 2026 |
|
CVE-2026-93282
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix maximum allowed access checks
The DACL permission check looks for an ACE matching the cur...
|
8.1 High | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-93280
In the Linux kernel, the following vulnerability has been resolved:
greybus: audio: bound the topology section sizes against the fetched size
gb_audio_gb_get_topology()...
|
8.8 High | — | 0,32% | 24 Sep 2026 |
|
CVE-2026-93277
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Validate udata before executing commands
The destroy callbacks currently zero the udat...
|
7.8 High | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-93265
In the Linux kernel, the following vulnerability has been resolved:
PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node
DSP3 has an integrated Et...
|
7.7 High | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-93262
In the Linux kernel, the following vulnerability has been resolved:
md/raid5-ppl: fix use-after-free in ppl_do_flush()
The loop in ppl_do_flush() continues iterating af...
|
7.8 High | — | 0,15% | 24 Sep 2026 |
|
CVE-2026-93260
In the Linux kernel, the following vulnerability has been resolved:
powerpc/xive: propagate IPI init errors to prevent use-after-free
When xive_init_ipis() fails (e.g....
|
7.4 High | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-93250
In the Linux kernel, the following vulnerability has been resolved:
vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
vxlan_mdb_flush() iterates over the MDB entries...
|
7.8 High | — | 0,16% | 24 Sep 2026 |
|
CVE-2026-93237
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
get_free_mem_region() and mhp_get_pluggable_range()...
|
7.8 High | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-93229
In the Linux kernel, the following vulnerability has been resolved:
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
The hand-rolled seqcount-like...
|
7.1 High | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-93228
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Reject Write/Reply chunks with segcount 0
A peer can send a Write or Reply chunk whose segc...
|
9.1 Critical | — | 0,47% | 24 Sep 2026 |
|
CVE-2026-93225
In the Linux kernel, the following vulnerability has been resolved:
phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
If probe fails after imx95_usb_phy_ge...
|
7.4 High | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-93224
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Fix unmatched rn_unregister on failed accept
When svc_rdma_accept() takes the errout path b...
|
8.1 High | — | 0,45% | 24 Sep 2026 |
|
CVE-2026-93221
In the Linux kernel, the following vulnerability has been resolved:
nfsd: convert nfsd_net boolean flags to unsigned long flags word
nfsd_net contains several boolean f...
|
8.1 High | — | 0,41% | 24 Sep 2026 |
|
CVE-2026-93207
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
svcauth_gss_decode_credbody()...
|
9.8 Critical | — | 0,47% | 24 Sep 2026 |
|
CVE-2026-88371
ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can ret...
|
5.5 Medium | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-92680
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryp...
|
5.5 Medium | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-88366
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specially crafted SVG document conta...
|
7.5 High | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-88370
libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allocates exact...
|
5.3 Medium | — | 0,29% | 24 Sep 2026 |
|
CVE-2026-88369
zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump().
|
7.3 High | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-88368
NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containin...
|
7.5 High | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-88365
minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field.
|
9.8 Critical | — | 0,36% | 24 Sep 2026 |
|
CVE-2026-88362
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large nu...
|
7.5 High | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-88361
SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.
|
7.5 High | — | 0,43% | 24 Sep 2026 |
|
CVE-2026-88358
simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural t...
|
6.5 Medium | — | 0,33% | 24 Sep 2026 |
|
CVE-2026-88355
An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including constants, variables, and zero...
|
7.5 High | — | 0,34% | 24 Sep 2026 |
|
CVE-2026-88357
nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd...
|
7.5 High | — | 0,61% | 24 Sep 2026 |
|
CVE-2026-79761
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow d...
|
6.6 Medium | — | 0,36% | 24 Sep 2026 |
|
CVE-2026-79760
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to...
|
6.4 Medium | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-79759
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-...
|
4.3 Medium | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-79758
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can acces...
|
5.4 Medium | — | 0,43% | 24 Sep 2026 |
|
CVE-2026-77581
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPriv...
|
8.6 High | — | 0,27% | 24 Sep 2026 |
|
CVE-2026-76907
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit docume...
|
6.5 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-75907
The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufactu...
|
7.5 High | — | 0,36% | 24 Sep 2026 |
|
CVE-2026-67233
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is_authorized/2 delegates to r...
|
6.0 Medium | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-63630
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON wi...
|
3.4 Low | — | 0,31% | 24 Sep 2026 |
|
CVE-2026-63203
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-pa...
|
7.6 High | — | 0,31% | 24 Sep 2026 |
|
CVE-2026-56739
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validatin...
|
8.5 High | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-56737
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: a...
|
8.1 High | — | 0,40% | 24 Sep 2026 |
|
CVE-2025-32000
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trus...
|
4.3 Medium | — | 0,21% | 24 Sep 2026 |