Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-86062
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking cont...
|
6.1 Medium | — | 0,25% | 22 Sep 2026 |
|
CVE-2026-86059
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider...
|
9.6 Critical | — | 0,49% | 22 Sep 2026 |
|
CVE-2026-85740
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py evaluates the literal resolve...
|
7.1 High | — | 0,22% | 22 Sep 2026 |
|
CVE-2026-85734
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit...
|
9.1 Critical | — | 0,36% | 22 Sep 2026 |
|
CVE-2026-85725
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password v...
|
5.9 Medium | — | 0,36% | 22 Sep 2026 |
|
CVE-2026-85709
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in documen...
|
5.3 Medium | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-84301
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/ap...
|
6.3 Medium | — | 0,29% | 22 Sep 2026 |
|
CVE-2026-83803
Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy...
|
7.7 High | — | 0,61% | 22 Sep 2026 |
|
CVE-2026-83603
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accept...
|
8.4 High | — | 0,32% | 22 Sep 2026 |
|
CVE-2026-83602
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_AC...
|
6.5 Medium | — | 0,36% | 22 Sep 2026 |
|
CVE-2026-83601
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to plug...
|
6.5 Medium | — | 0,37% | 22 Sep 2026 |
|
CVE-2026-83600
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd...
|
6.5 Medium | — | 0,55% | 22 Sep 2026 |
|
CVE-2026-83599
Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web...
|
7.5 High | — | 0,74% | 22 Sep 2026 |
|
CVE-2026-83598
Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and l...
|
7.8 High | — | 0,16% | 22 Sep 2026 |
|
CVE-2026-76805
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runt...
|
5.3 Medium | — | 0,41% | 22 Sep 2026 |
|
CVE-2026-76804
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate...
|
5.5 Medium | — | 0,17% | 22 Sep 2026 |
|
CVE-2026-76803
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox w...
|
5.3 Medium | — | 0,40% | 22 Sep 2026 |
|
CVE-2026-76802
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template si...
|
4.7 Medium | — | 0,18% | 22 Sep 2026 |
|
CVE-2026-56682
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the cl...
|
5.3 Medium | — | 0,47% | 22 Sep 2026 |
|
CVE-2026-95806
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.
The phar stream wrapper causes PHP to treat a phar archive...
|
7.7 High | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-95805
A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled...
|
5.3 Medium | — | 0,41% | 22 Sep 2026 |
|
CVE-2026-95655
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can sub...
|
8.1 High | — | 0,49% | 22 Sep 2026 |
|
CVE-2026-95654
Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during a...
|
7.4 High | — | 0,51% | 22 Sep 2026 |
|
CVE-2026-95653
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unau...
|
7.5 High | — | 0,57% | 22 Sep 2026 |
|
CVE-2026-94640
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests....
|
7.5 High | — | 0,43% | 22 Sep 2026 |
|
CVE-2026-92706
Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline...
|
3.4 Low | — | 0,17% | 22 Sep 2026 |
|
CVE-2026-90462
fedoraproject sssd, redhat openshift container platform +1 lainnya
A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolic...
|
5.4 Medium | — | 0,18% | 22 Sep 2026 |
|
CVE-2026-88010
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the BasicAuth sin...
|
6.3 Medium | — | 0,69% | 22 Sep 2026 |
|
CVE-2026-86805
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to es...
|
6.3 Medium | — | 0,10% | 22 Sep 2026 |
|
CVE-2026-86698
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the...
|
2.3 Low | — | 0,43% | 22 Sep 2026 |
|
CVE-2026-85055
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on Gr...
|
7.1 High | — | 0,43% | 22 Sep 2026 |
|
CVE-2026-81886
radare2
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the...
|
5.5 Medium | — | 0,13% | 22 Sep 2026 |
|
CVE-2026-81885
radare2
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE re...
|
5.5 Medium | — | 0,13% | 22 Sep 2026 |
|
CVE-2026-81884
radare2
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LC_DATA_IN_CODE parser was vulnerable because the Mach-O L...
|
3.3 Low | — | 0,15% | 22 Sep 2026 |
|
CVE-2026-81883
radare2
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Lua 5.3 bytecode function parser was vulnerable because the Lua 5...
|
3.3 Low | — | 0,16% | 22 Sep 2026 |
|
CVE-2026-81882
radare2
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the bi...
|
6.1 Medium | — | 0,13% | 22 Sep 2026 |
|
CVE-2026-81881
radare2
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relat...
|
4.4 Medium | — | 0,13% | 22 Sep 2026 |
|
CVE-2026-81880
radare2
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Apple Preferred Executable Format loader was vulnerable because t...
|
5.5 Medium | — | 0,14% | 22 Sep 2026 |
|
CVE-2026-81879
radare2
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PN_XNUM handling was vulnerable because the ELF parser alloca...
|
6.1 Medium | — | 0,18% | 22 Sep 2026 |
|
CVE-2026-81878
radare2
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the C...
|
5.5 Medium | — | 0,20% | 22 Sep 2026 |
|
CVE-2026-80156
Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-0...
|
9.1 Critical | — | 0,70% | 22 Sep 2026 |
|
CVE-2026-80155
Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-0...
|
10.0 Critical | — | 1,0% | 22 Sep 2026 |
|
CVE-2026-80154
All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management p...
|
9.6 Critical | — | 0,63% | 22 Sep 2026 |
|
CVE-2026-80152
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-0...
|
9.1 Critical | — | 1,7% | 22 Sep 2026 |
|
CVE-2026-80151
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-0...
|
9.1 Critical | — | 1,7% | 22 Sep 2026 |
|
CVE-2026-80150
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a serv...
|
7.5 High | — | 0,58% | 22 Sep 2026 |
|
CVE-2026-80149
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a serv...
|
8.6 High | — | 0,58% | 22 Sep 2026 |
|
CVE-2026-80148
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a serv...
|
8.6 High | — | 0,58% | 22 Sep 2026 |
|
CVE-2026-80147
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based bu...
|
9.9 Critical | — | 0,46% | 22 Sep 2026 |
|
CVE-2026-80146
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based bu...
|
9.9 Critical | — | 0,85% | 22 Sep 2026 |