Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-95843
moquette
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName bef...
|
7.5 High | — | 0,43% | 23 Sep 2026 |
|
CVE-2026-95842
moquette
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminat...
|
7.5 High | — | 0,43% | 23 Sep 2026 |
|
CVE-2026-93349
Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descr...
|
8.8 High | — | 2,1% | 23 Sep 2026 |
|
CVE-2026-88832
BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.
|
7.3 High | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-88830
A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange messag...
|
7.5 High | — | 0,35% | 23 Sep 2026 |
|
CVE-2026-85724
moquette
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and...
|
9.6 Critical | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-6669
Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compr...
|
5.9 Medium | — | 0,31% | 23 Sep 2026 |
|
CVE-2026-6668
Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large...
|
7.5 High | — | 0,40% | 23 Sep 2026 |
|
CVE-2026-19888
Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the pr...
|
7.5 High | — | 0,39% | 23 Sep 2026 |
|
CVE-2025-63564
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests
|
9.8 Critical | — | 0,51% | 23 Sep 2026 |
|
CVE-2026-96675
alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers...
|
3.3 Low | — | 0,11% | 23 Sep 2026 |
|
CVE-2026-96674
alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Att...
|
4.4 Medium | — | 0,11% | 23 Sep 2026 |
|
CVE-2026-96673
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_...
|
7.5 High | — | 0,42% | 23 Sep 2026 |
|
CVE-2026-96672
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to fra...
|
6.4 Medium | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-93769
HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permissio...
|
7.2 High | — | 0,28% | 23 Sep 2026 |
|
CVE-2026-79310
webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-controlled template code that built-i...
|
8.5 High | — | 0,72% | 23 Sep 2026 |
|
CVE-2026-79306
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker wi...
|
6.5 Medium | — | 0,48% | 23 Sep 2026 |
|
CVE-2026-79304
CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with own...
|
6.5 Medium | — | 0,54% | 23 Sep 2026 |
|
CVE-2026-6327
ibm concert
IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log f...
|
4.3 Medium | — | 0,17% | 23 Sep 2026 |
|
CVE-2026-4921
IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. T...
|
2.7 Low | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-3626
ibm concert
IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This inf...
|
5.3 Medium | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-19267
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`CommandsResour...
|
6.2 Medium | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-19179
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elemen...
|
8.2 High | — | 0,30% | 23 Sep 2026 |
|
CVE-2026-19087
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper privilege m...
|
4.4 Medium | — | 0,09% | 23 Sep 2026 |
|
CVE-2026-18875
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.ve...
|
7.3 High | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-18872
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (N...
|
9.3 Critical | — | 0,19% | 23 Sep 2026 |
|
CVE-2026-18505
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An unauthenticate...
|
5.4 Medium | — | 0,15% | 23 Sep 2026 |
|
CVE-2026-18490
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business...
|
8.8 High | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-18185
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing...
|
7.3 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-18184
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection f...
|
7.4 High | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-18181
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded c...
|
8.1 High | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-18180
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
|
6.5 Medium | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-96611
ffmpeg
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed...
|
7.8 High | — | 0,11% | 23 Sep 2026 |
|
CVE-2026-96609
Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This...
|
7.1 High | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-96600
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-suppl...
|
5.5 Medium | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-96599
Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identif...
|
5.9 Medium | — | 0,38% | 23 Sep 2026 |
|
CVE-2026-96276
If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with th...
|
6.5 Medium | — | 0,37% | 23 Sep 2026 |
|
CVE-2026-96275
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system inst...
|
8.8 High | — | 0,40% | 23 Sep 2026 |
|
CVE-2026-92419
WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API do...
|
5.3 Medium | — | 0,31% | 23 Sep 2026 |
|
CVE-2026-92164
Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and...
|
6.5 Medium | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-88974
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_...
|
5.4 Medium | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-73858
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluate...
|
5.3 Medium | — | 0,43% | 23 Sep 2026 |
|
CVE-2026-73591
dell policy manager for secure connect gateway
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenti...
|
7.5 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-73589
dell policy manager for secure connect gateway
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privile...
|
6.3 Medium | — | 0,08% | 23 Sep 2026 |
|
CVE-2026-73588
dell policy manager for secure connect gateway
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated...
|
7.4 High | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-73587
dell policy manager for secure connect gateway
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker wit...
|
6.8 Medium | — | 0,08% | 23 Sep 2026 |
|
CVE-2026-73586
dell policy manager for secure connect gateway
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with...
|
6.4 Medium | — | 0,11% | 23 Sep 2026 |
|
CVE-2026-71178
dell policy manager for secure connect gateway
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An u...
|
3.7 Low | — | 0,16% | 23 Sep 2026 |
|
CVE-2026-71177
dell policy manager for secure connect gateway
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low priv...
|
5.4 Medium | — | 0,14% | 23 Sep 2026 |
|
CVE-2026-63002
REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesyste...
|
4.8 Medium | — | 0,18% | 23 Sep 2026 |