Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-63001
REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Mana...
|
4.8 Medium | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-63000
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the...
|
6.4 Medium | — | 0,13% | 23 Sep 2026 |
|
CVE-2026-62998
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without che...
|
4.3 Medium | — | 0,27% | 23 Sep 2026 |
|
CVE-2026-61834
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks whil...
|
4.3 Medium | — | 0,28% | 23 Sep 2026 |
|
CVE-2026-61413
dell policy manager for secure connect gateway
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attacker with re...
|
6.8 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-55610
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShel...
|
8.7 High | — | 0,30% | 23 Sep 2026 |
|
CVE-2026-96560
LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated R...
|
9.8 Critical | — | 0,65% | 23 Sep 2026 |
|
CVE-2026-96512
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the t...
|
7.8 High | — | 0,14% | 23 Sep 2026 |
|
CVE-2026-86708
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager...
|
10.0 Critical | — | 1,2% | 23 Sep 2026 |
|
CVE-2026-86683
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.
|
8.1 High | — | 0,68% | 23 Sep 2026 |
|
CVE-2026-86681
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute admini...
|
7.6 High | — | 0,46% | 23 Sep 2026 |
|
CVE-2026-86679
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete servic...
|
7.1 High | — | 0,78% | 23 Sep 2026 |
|
CVE-2026-86678
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrato...
|
8.8 High | — | 0,68% | 23 Sep 2026 |
|
CVE-2026-86677
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator acc...
|
8.8 High | — | 2,0% | 23 Sep 2026 |
|
CVE-2026-59167
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistentl...
|
10.0 Critical | — | 0,39% | 23 Sep 2026 |
|
CVE-2026-18179
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization.
|
6.5 Medium | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-18177
ibm financial transaction manager
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks.
|
7.1 High | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-12974
A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).
This issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, fro...
|
7.9 High | — | 0,29% | 23 Sep 2026 |
|
CVE-2026-95676
watchguard authentication gateway
A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-fact...
|
7.5 High | — | 0,38% | 23 Sep 2026 |
|
CVE-2026-86247
apache tomcat native
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
Th...
|
7.4 High | — | 0,22% | 23 Sep 2026 |
|
CVE-2026-86246
apache tomcat native
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_...
|
9.1 Critical | — | 0,36% | 23 Sep 2026 |
|
CVE-2026-86243
apache tomcat native
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache To...
|
7.5 High | — | 0,61% | 23 Sep 2026 |
|
CVE-2026-84091
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking th...
|
5.3 Medium | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-77112
Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery.
This issue affects Weoll: be...
|
6.5 Medium | — | 0,21% | 23 Sep 2026 |
|
CVE-2026-76980
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collect...
|
7.4 High | — | 0,39% | 23 Sep 2026 |
|
CVE-2026-76979
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies...
|
7.7 High | — | 1,1% | 23 Sep 2026 |
|
CVE-2026-76978
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.
|
8.8 High | — | 3,7% | 23 Sep 2026 |
|
CVE-2026-75825
ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability.
|
8.8 High | — | 1,1% | 23 Sep 2026 |
|
CVE-2026-19599
ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.
|
9.9 Critical | — | 2,9% | 23 Sep 2026 |
|
CVE-2026-96446
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allow...
|
4.2 Medium | — | 0,18% | 23 Sep 2026 |
|
CVE-2026-96445
A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP he...
|
6.8 Medium | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-87022
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used.
This issue affe...
|
7.5 High | — | 0,42% | 23 Sep 2026 |
|
CVE-2026-86350
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can tri...
|
9.1 Critical | — | 0,31% | 23 Sep 2026 |
|
CVE-2026-86248
Advisory
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: fr...
|
9.8 Critical | — | 0,39% | 23 Sep 2026 |
|
CVE-2026-84791
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated l...
|
7.1 High | — | 0,60% | 23 Sep 2026 |
|
CVE-2026-84789
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated l...
|
7.1 High | — | 0,60% | 23 Sep 2026 |
|
CVE-2026-84787
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated lo...
|
8.1 High | — | 0,85% | 23 Sep 2026 |
|
CVE-2026-80444
URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation.
This issue affects AVESİS: from 2026...
|
5.4 Medium | — | 0,14% | 23 Sep 2026 |
|
CVE-2026-79677
Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time ou...
|
7.5 High | — | 0,32% | 23 Sep 2026 |
|
CVE-2026-78437
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.
This issue...
|
7.3 High | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-78383
Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denia...
|
7.5 High | — | 0,38% | 23 Sep 2026 |
|
CVE-2026-78253
Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a...
|
2.3 Low | — | 0,25% | 23 Sep 2026 |
|
CVE-2026-77791
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.
This issue affects Apache Tomcat: from...
|
7.5 High | — | 0,53% | 23 Sep 2026 |
|
CVE-2026-77762
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields int...
|
8.1 High | — | 0,36% | 23 Sep 2026 |
|
CVE-2026-77756
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an H...
|
3.7 Low | — | 0,26% | 23 Sep 2026 |
|
CVE-2026-76183
Advisory
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed.
This issue affects A...
|
9.8 Critical | — | 0,39% | 23 Sep 2026 |
|
CVE-2026-75973
Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web...
|
7.3 High | — | 0,24% | 23 Sep 2026 |
|
CVE-2026-73581
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystor...
|
6.5 Medium | — | 0,12% | 23 Sep 2026 |
|
CVE-2026-15358
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.
|
7.5 High | — | 1,1% | 23 Sep 2026 |
|
CVE-2026-14913
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.
|
8.8 High | — | 0,97% | 23 Sep 2026 |