Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-80145
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command inject...
|
9.1 Critical | — | 1,7% | 22 Sep 2026 |
|
CVE-2026-80144
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command inject...
|
9.9 Critical | — | 1,5% | 22 Sep 2026 |
|
CVE-2026-80143
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command inject...
|
9.9 Critical | — | 1,5% | 22 Sep 2026 |
|
CVE-2026-79913
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes re...
|
6.5 Medium | — | 0,40% | 22 Sep 2026 |
|
CVE-2026-79311
webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().
|
6.1 Medium | — | 0,19% | 22 Sep 2026 |
|
CVE-2026-79312
webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store...
|
6.8 Medium | — | 0,29% | 22 Sep 2026 |
|
CVE-2026-77637
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omi...
|
3.8 Low | — | 0,33% | 22 Sep 2026 |
|
CVE-2026-77633
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage v...
|
7.1 High | — | 0,37% | 22 Sep 2026 |
|
CVE-2026-77621
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result withou...
|
9.3 Critical | — | 1,1% | 22 Sep 2026 |
|
CVE-2026-77620
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiti...
|
8.7 High | — | 0,52% | 22 Sep 2026 |
|
CVE-2026-77619
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses i...
|
8.7 High | — | 0,52% | 22 Sep 2026 |
|
CVE-2026-75608
Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requi...
|
7.7 High | — | 0,37% | 22 Sep 2026 |
|
CVE-2026-75607
Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatche...
|
8.1 High | — | 0,64% | 22 Sep 2026 |
|
CVE-2026-75517
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integr...
|
6.5 Medium | — | 0,70% | 22 Sep 2026 |
|
CVE-2026-75511
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel...
|
5.3 Medium | — | 0,46% | 22 Sep 2026 |
|
CVE-2026-75510
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notif...
|
5.1 Medium | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-70410
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiation (via AvaticaUtils#instant...
|
8.8 High | — | 0,64% | 22 Sep 2026 |
|
CVE-2026-63374
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() c...
|
9.3 Critical | — | 0,29% | 22 Sep 2026 |
|
CVE-2026-56681
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the...
|
7.3 High | — | 0,97% | 22 Sep 2026 |
|
CVE-2026-95754
In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification branch did not include the User...
|
6.9 Medium | — | 0,54% | 22 Sep 2026 |
|
CVE-2026-95703
In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF readin...
|
5.1 Medium | — | 0,51% | 22 Sep 2026 |
|
CVE-2026-95701
In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an orga...
|
5.1 Medium | — | 0,76% | 22 Sep 2026 |
|
CVE-2026-95698
The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a fi...
|
5.3 Medium | — | 0,72% | 22 Sep 2026 |
|
CVE-2026-95697
MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organiz...
|
5.3 Medium | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-95693
In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the s...
|
5.3 Medium | — | 0,51% | 22 Sep 2026 |
|
CVE-2026-95685
MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an ev...
|
5.3 Medium | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-95683
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event...
|
5.3 Medium | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-95501
A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the co...
|
4.3 Medium | — | 0,31% | 22 Sep 2026 |
|
CVE-2026-95500
A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the co...
|
7.3 High | — | 0,47% | 22 Sep 2026 |
|
CVE-2026-94570
SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote...
|
5.9 Medium | — | 0,47% | 22 Sep 2026 |
|
CVE-2026-94127
Advisory
f5 big-ip access policy manager
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerab...
|
9.8 Critical | KEV | 2,2% | 22 Sep 2026 |
|
CVE-2026-93344
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated atta...
|
6.5 Medium | — | 0,43% | 22 Sep 2026 |
|
CVE-2026-93088
SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds...
|
9.8 Critical | — | 0,73% | 22 Sep 2026 |
|
CVE-2026-89407
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][...
|
7.5 High | — | 0,55% | 22 Sep 2026 |
|
CVE-2026-84388
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions ma...
|
9.6 Critical | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-79315
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression...
|
4.7 Medium | — | 0,27% | 22 Sep 2026 |
|
CVE-2026-79314
A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark,...
|
8.8 High | — | 0,30% | 22 Sep 2026 |
|
CVE-2026-79313
webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking...
|
9.8 Critical | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-65179
nvidia nemo speech
NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation....
|
8.8 High | — | 0,76% | 22 Sep 2026 |
|
CVE-2026-65178
nvidia nemo speech
NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of t...
|
7.8 High | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-65130
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might l...
|
9.8 Critical | — | 1,6% | 22 Sep 2026 |
|
CVE-2026-65129
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerabil...
|
8.3 High | — | 0,24% | 22 Sep 2026 |
|
CVE-2026-65128
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to...
|
8.8 High | — | 0,67% | 22 Sep 2026 |
|
CVE-2026-65127
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug informat...
|
4.9 Medium | — | 0,29% | 22 Sep 2026 |
|
CVE-2026-65126
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of t...
|
8.8 High | — | 0,34% | 22 Sep 2026 |
|
CVE-2026-65125
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vu...
|
8.8 High | — | 0,57% | 22 Sep 2026 |
|
CVE-2026-65124
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead...
|
8.1 High | — | 0,44% | 22 Sep 2026 |
|
CVE-2026-65121
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue. A successful exploit of this vulnerab...
|
9.8 Critical | — | 0,42% | 22 Sep 2026 |
|
CVE-2026-65118
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerabil...
|
9.8 Critical | — | 0,23% | 22 Sep 2026 |
|
CVE-2026-65117
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability...
|
8.8 High | — | 0,20% | 22 Sep 2026 |