Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-73064
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. T...
|
2.9 Low | — | 0,10% | 24 Sep 2026 |
|
CVE-2026-6544
ibm concert
IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary file...
|
6.2 Medium | — | 0,12% | 24 Sep 2026 |
|
CVE-2026-65422
A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails.
|
6.5 Medium | — | 0,20% | 24 Sep 2026 |
|
CVE-2026-58008
Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue af...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-58007
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-58006
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-58005
Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.
This issue affects Trusted Firmware: through socfpga...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-58004
Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.
This issue affects Trusted Firmware: through socfpga...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-56736
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low...
|
8.2 High | — | 0,24% | 24 Sep 2026 |
|
CVE-2026-52001
An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib...
|
7.5 High | — | 0,47% | 24 Sep 2026 |
|
CVE-2026-51997
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions
|
8.8 High | — | 0,53% | 24 Sep 2026 |
|
CVE-2026-51996
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function
|
9.8 Critical | — | 0,47% | 24 Sep 2026 |
|
CVE-2026-51995
An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/uti...
|
7.5 High | — | 0,47% | 24 Sep 2026 |
|
CVE-2026-51994
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Auth...
|
9.1 Critical | — | 0,35% | 24 Sep 2026 |
|
CVE-2026-19492
ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +17 lainnya
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a hypervisor call inter...
|
3.2 Low | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-18870
ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +24 lainnya
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker...
|
4.3 Medium | — | 0,19% | 24 Sep 2026 |
|
CVE-2026-13467
Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue affects Tr...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-13466
Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers.
This issue affects Trusted Firmware: through socfpga_v2.14....
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-13465
Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.
This issue af...
|
8.1 High | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-12559
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certai...
|
7.3 High | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-97360
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete fi...
|
10.0 Critical | — | 0,32% | 24 Sep 2026 |
|
CVE-2026-97359
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code ex...
|
10.0 Critical | — | 0,78% | 24 Sep 2026 |
|
CVE-2026-97062
Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users...
|
5.4 Medium | — | 0,21% | 24 Sep 2026 |
|
CVE-2026-97061
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the inst...
|
4.3 Medium | — | 0,22% | 24 Sep 2026 |
|
CVE-2026-97059
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against th...
|
8.2 High | — | 0,35% | 24 Sep 2026 |
|
CVE-2026-97057
redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an ex...
|
7.5 High | — | 0,39% | 24 Sep 2026 |
|
CVE-2026-95521
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute a...
|
7.8 High | — | 0,58% | 24 Sep 2026 |
|
CVE-2026-95519
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flow...
|
7.8 High | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-88360
libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-ba...
|
7.5 High | — | 0,26% | 24 Sep 2026 |
|
CVE-2026-91187
Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare...
|
9.3 Critical | — | 0,30% | 24 Sep 2026 |
|
CVE-2026-88359
libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or fo...
|
6.5 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-77798
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.
|
6.5 Medium | — | 0,20% | 24 Sep 2026 |
|
CVE-2026-77797
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.
|
3.6 Low | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-18857
ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +15 lainnya
IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interf...
|
3.4 Low | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-18104
ibm db2 mirror for i
IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryptio...
|
3.3 Low | — | 0,06% | 24 Sep 2026 |
|
CVE-2026-17511
ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +24 lainnya
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability...
|
3.4 Low | — | 0,13% | 24 Sep 2026 |
|
CVE-2026-17504
ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +24 lainnya
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability...
|
4.4 Medium | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-17503
ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +24 lainnya
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability...
|
5.1 Medium | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-17413
ibm power system s1122 (9824-22a) firmware, ibm power system s1124 (9824-42a) firmware +24 lainnya
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability...
|
5.1 Medium | — | 0,11% | 24 Sep 2026 |
|
CVE-2026-97182
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/conten...
|
7.3 High | — | 0,37% | 24 Sep 2026 |
|
CVE-2026-96515
This
vulnerability exists in the Netlink ICT HG323RW router due to insufficient
authorization and input validation controls in the diagnostic script import
functionality....
|
8.6 High | — | 0,31% | 24 Sep 2026 |
|
CVE-2026-94416
An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for...
|
6.8 Medium | — | 0,45% | 24 Sep 2026 |
|
CVE-2026-88916
Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation.
This issue affects UlakPDF: through 09092026.
|
6.8 Medium | — | 0,21% | 24 Sep 2026 |
|
CVE-2026-88907
Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass.
This issue affects UlakPDF: through 09092026.
|
7.4 High | — | 0,32% | 24 Sep 2026 |
|
CVE-2026-19072
Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_...
|
9.9 Critical | — | 0,40% | 24 Sep 2026 |
|
CVE-2026-97311
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do n...
|
4.3 Medium | — | 0,25% | 24 Sep 2026 |
|
CVE-2026-7169
a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious...
|
7.5 High | — | 0,14% | 24 Sep 2026 |
|
CVE-2026-4806
The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the save_option(...
|
6.5 Medium | — | 0,17% | 24 Sep 2026 |
|
CVE-2026-3253
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method o...
|
4.3 Medium | — | 0,16% | 24 Sep 2026 |
|
CVE-2026-19532
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal.
This issue affects Liman M...
|
5.3 Medium | — | 0,26% | 24 Sep 2026 |