Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-97404
In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote a...
|
9.2 Critical | — | 0,27% | 24 Sep 2026 |
|
CVE-2026-97362
HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by...
|
7.5 High | — | 0,29% | 24 Sep 2026 |
|
CVE-2026-97224
A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Impo...
|
4.3 Medium | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-90959
A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a...
|
8.1 High | — | 0,32% | 24 Sep 2026 |
|
CVE-2026-90481
In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.
|
9.2 Critical | — | 0,33% | 24 Sep 2026 |
|
CVE-2026-88351
An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object wi...
|
9.8 Critical | — | 0,31% | 24 Sep 2026 |
|
CVE-2026-82094
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to...
|
7.1 High | — | 0,31% | 24 Sep 2026 |
|
CVE-2026-82093
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.
|
8.8 High | — | 0,42% | 24 Sep 2026 |
|
CVE-2026-81552
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variab...
|
8.8 High | — | 0,77% | 24 Sep 2026 |
|
CVE-2026-81549
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Prot...
|
7.7 High | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-81548
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements u...
|
8.8 High | — | 0,77% | 24 Sep 2026 |
|
CVE-2026-81547
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal.
|
8.8 High | — | 0,94% | 24 Sep 2026 |
|
CVE-2026-81545
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements u...
|
8.8 High | — | 0,88% | 24 Sep 2026 |
|
CVE-2026-81539
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used...
|
8.8 High | — | 0,45% | 24 Sep 2026 |
|
CVE-2026-77874
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send spec...
|
8.6 High | — | 0,43% | 24 Sep 2026 |
|
CVE-2026-77825
ibm contextforge
IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`). The path confinement...
|
4.9 Medium | — | 0,32% | 24 Sep 2026 |
|
CVE-2026-77707
Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM).
This issue affects Liman Render Engine: from 1....
|
5.9 Medium | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-77703
Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM).
This issue affects Liman Render Engi...
|
5.9 Medium | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-73064
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. T...
|
2.9 Low | — | 0,10% | 24 Sep 2026 |
|
CVE-2026-6544
ibm concert
IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary file...
|
6.2 Medium | — | 0,12% | 24 Sep 2026 |
|
CVE-2026-65422
A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails.
|
6.5 Medium | — | 0,20% | 24 Sep 2026 |
|
CVE-2026-58008
Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue af...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-58007
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-58006
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-58005
Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.
This issue affects Trusted Firmware: through socfpga...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-58004
Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.
This issue affects Trusted Firmware: through socfpga...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-56736
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low...
|
8.2 High | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-52001
An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib...
|
7.5 High | — | 0,47% | 24 Sep 2026 |
|
CVE-2026-51997
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions
|
8.8 High | — | 0,53% | 24 Sep 2026 |
|
CVE-2026-51996
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function
|
9.8 Critical | — | 0,47% | 24 Sep 2026 |
|
CVE-2026-51995
An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/uti...
|
7.5 High | — | 0,47% | 24 Sep 2026 |
|
CVE-2026-51994
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Auth...
|
9.1 Critical | — | 0,35% | 24 Sep 2026 |
|
CVE-2026-19492
ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +17 lainnya
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a hypervisor call inter...
|
3.2 Low | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-18870
ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +24 lainnya
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker...
|
4.3 Medium | — | 0,19% | 24 Sep 2026 |
|
CVE-2026-13467
Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue affects Tr...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-13466
Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers.
This issue affects Trusted Firmware: through socfpga_v2.14....
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-13465
Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue af...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-12559
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certai...
|
7.3 High | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-97360
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete fi...
|
10.0 Critical | — | 0,32% | 24 Sep 2026 |
|
CVE-2026-97359
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code ex...
|
10.0 Critical | — | 0,78% | 24 Sep 2026 |
|
CVE-2026-97062
Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users...
|
5.4 Medium | — | 0,21% | 24 Sep 2026 |
|
CVE-2026-97061
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the inst...
|
4.3 Medium | — | 0,22% | 24 Sep 2026 |
|
CVE-2026-97059
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against th...
|
8.2 High | — | 0,35% | 24 Sep 2026 |
|
CVE-2026-97057
redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an ex...
|
7.5 High | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-95521
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute a...
|
7.8 High | — | 0,58% | 24 Sep 2026 |
|
CVE-2026-95519
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flow...
|
7.8 High | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-88360
libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-ba...
|
7.5 High | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-91187
Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare...
|
9.3 Critical | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-88359
libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or fo...
|
6.5 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-77798
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.
|
6.5 Medium | — | 0,20% | 24 Sep 2026 |