Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-76715
arubanetworks analytics and location engine
A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this...
|
7.1 High | — | 0,26% | 22 Sep 2026 |
|
CVE-2026-76714
arubanetworks analytics and location engine
Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploi...
|
7.2 High | — | 0,84% | 22 Sep 2026 |
|
CVE-2026-76713
arubanetworks analytics and location engine
A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authe...
|
7.2 High | — | 0,55% | 22 Sep 2026 |
|
CVE-2026-76712
arubanetworks analytics and location engine
A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated...
|
7.3 High | — | 0,41% | 22 Sep 2026 |
|
CVE-2026-76711
arubanetworks analytics and location engine
A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated...
|
7.5 High | — | 0,46% | 22 Sep 2026 |
|
CVE-2026-76710
arubanetworks analytics and location engine
A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remo...
|
7.5 High | — | 0,54% | 22 Sep 2026 |
|
CVE-2026-76709
arubanetworks analytics and location engine
A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unaut...
|
9.8 Critical | — | 0,59% | 22 Sep 2026 |
|
CVE-2026-76708
arubanetworks analytics and location engine
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several ad...
|
9.8 Critical | — | 0,59% | 22 Sep 2026 |
|
CVE-2026-75432
An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scanner::PushIndentTo() components
|
5.1 Medium | — | 0,17% | 22 Sep 2026 |
|
CVE-2026-65829
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera...
|
5.3 Medium | — | 0,34% | 22 Sep 2026 |
|
CVE-2026-63628
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied acc...
|
6.9 Medium | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-63627
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sp...
|
6.9 Medium | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-63104
Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and mo...
|
8.1 High | — | 0,49% | 22 Sep 2026 |
|
CVE-2026-62985
request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFil...
|
7.5 High | — | 0,46% | 22 Sep 2026 |
|
CVE-2026-61570
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuild...
|
7.5 High | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-59991
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacke...
|
7.5 High | — | 0,52% | 22 Sep 2026 |
|
CVE-2026-58268
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the clie...
|
7.5 High | — | 0,61% | 22 Sep 2026 |
|
CVE-2026-47116
LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with...
|
9.8 Critical | — | 0,51% | 22 Sep 2026 |
|
CVE-2026-28325
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data wh...
|
8.8 High | — | 1,5% | 22 Sep 2026 |
|
CVE-2026-28324
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installa...
|
9.8 Critical | — | 0,65% | 22 Sep 2026 |
|
CVE-2026-95862
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS...
|
7.5 High | — | 0,46% | 22 Sep 2026 |
|
CVE-2026-95861
A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (...
|
7.5 High | — | 0,46% | 22 Sep 2026 |
|
CVE-2026-95831
Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL.
The generate_certificate runs a Pytho...
|
7.8 High | — | 0,12% | 22 Sep 2026 |
|
CVE-2026-94462
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::...
|
7.1 High | — | 0,28% | 22 Sep 2026 |
|
CVE-2026-91130
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statisti...
|
9.3 Critical | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-91129
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticate...
|
5.4 Medium | — | 0,20% | 22 Sep 2026 |
|
CVE-2026-89277
adobe c2pa, adobe c2patool
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit th...
|
5.5 Medium | — | 0,25% | 22 Sep 2026 |
|
CVE-2026-88415
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.
|
8.7 High | — | 0,31% | 22 Sep 2026 |
|
CVE-2026-88414
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
|
9.8 Critical | — | 0,42% | 22 Sep 2026 |
|
CVE-2026-84396
InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerabili...
|
5.5 Medium | — | 0,14% | 22 Sep 2026 |
|
CVE-2026-84395
Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulting in unauthorized write acces...
|
7.1 High | — | 0,25% | 22 Sep 2026 |
|
CVE-2026-83964
adobe connect, adobe connect for mobile
Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerabi...
|
7.5 High | — | 0,22% | 22 Sep 2026 |
|
CVE-2026-83963
adobe substance 3d modeler
Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o...
|
7.8 High | — | 0,14% | 22 Sep 2026 |
|
CVE-2026-83962
adobe substance 3d modeler
Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit...
|
7.8 High | — | 0,17% | 22 Sep 2026 |
|
CVE-2026-82000
Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker...
|
9.6 Critical | — | 0,73% | 22 Sep 2026 |
|
CVE-2026-81999
Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high priv...
|
8.7 High | — | 0,81% | 22 Sep 2026 |
|
CVE-2026-81998
adobe substance 3d modeler
Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o...
|
7.8 High | — | 0,14% | 22 Sep 2026 |
|
CVE-2026-81995
Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current u...
|
9.1 Critical | — | 1,2% | 22 Sep 2026 |
|
CVE-2026-79906
adobe substance 3d modeler
Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o...
|
7.8 High | — | 0,14% | 22 Sep 2026 |
|
CVE-2026-77558
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS)...
|
7.5 High | — | 0,52% | 22 Sep 2026 |
|
CVE-2026-77556
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS)...
|
7.5 High | — | 0,52% | 22 Sep 2026 |
|
CVE-2026-77555
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS...
|
7.5 High | — | 0,46% | 22 Sep 2026 |
|
CVE-2026-77544
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS...
|
7.5 High | — | 0,52% | 22 Sep 2026 |
|
CVE-2026-77399
icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical accepts an attacker-controlled VALARM REPEA...
|
6.5 Medium | — | 0,31% | 22 Sep 2026 |
|
CVE-2026-77272
mcp-atlassian mcp atlassian
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth error query parameter is passed to Callbac...
|
6.1 Medium | — | 0,25% | 22 Sep 2026 |
|
CVE-2026-77269
mcp-atlassian mcp atlassian
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the remediation for CVE-2026-27825 protects download...
|
6.5 Medium | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-77268
mcp-atlassian mcp atlassian
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are...
|
5.5 Medium | — | 0,12% | 22 Sep 2026 |
|
CVE-2026-77266
mcp-atlassian mcp atlassian
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and travers...
|
6.5 Medium | — | 0,44% | 22 Sep 2026 |
|
CVE-2026-77262
mcp-atlassian mcp atlassian
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an attacker-con...
|
8.6 High | — | 0,49% | 22 Sep 2026 |
|
CVE-2026-77259
mcp-atlassian mcp atlassian
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected...
|
7.7 High | — | 0,41% | 22 Sep 2026 |