Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-65115
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. A successful exploit of this vulnerabil...
|
6.5 Medium | — | 0,59% | 22 Sep 2026 |
|
CVE-2026-65114
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of...
|
9.8 Critical | — | 0,45% | 22 Sep 2026 |
|
CVE-2026-65113
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerabilit...
|
9.8 Critical | — | 0,67% | 22 Sep 2026 |
|
CVE-2026-65112
nvidia infra controller
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerab...
|
6.5 Medium | — | 0,59% | 22 Sep 2026 |
|
CVE-2026-65111
nvidia nemo speech
NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection. A successful exploit of this vuln...
|
7.8 High | — | 0,25% | 22 Sep 2026 |
|
CVE-2026-24267
nvidia nemo speech
NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code e...
|
7.8 High | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-24239
nvidia nemo speech
NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. A successful exploit of this...
|
7.8 High | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-19915
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.55.10.0. The vulnerability could potentially allow a local atta...
|
7.3 High | — | 0,11% | 22 Sep 2026 |
|
CVE-2026-95682
MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly in...
|
4.8 Medium | — | 0,42% | 22 Sep 2026 |
|
CVE-2026-95679
MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains a logic error in its readFile...
|
6.9 Medium | — | 0,60% | 22 Sep 2026 |
|
CVE-2026-95675
D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary comman...
|
9.8 Critical | — | 2,1% | 22 Sep 2026 |
|
CVE-2026-95674
In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specifi...
|
5.3 Medium | — | 0,41% | 22 Sep 2026 |
|
CVE-2026-95671
In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. H...
|
5.3 Medium | — | 0,37% | 22 Sep 2026 |
|
CVE-2026-95667
The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_...
|
6.9 Medium | — | 0,18% | 22 Sep 2026 |
|
CVE-2026-95666
mattermost server
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions...
|
4.3 Medium | — | 0,37% | 22 Sep 2026 |
|
CVE-2026-95665
MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSear...
|
5.1 Medium | — | 0,54% | 22 Sep 2026 |
|
CVE-2026-95499
A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_uploaded_file of the file filemanager.php. Executin...
|
7.3 High | — | 0,47% | 22 Sep 2026 |
|
CVE-2026-95396
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java...
|
4.3 Medium | — | 0,47% | 22 Sep 2026 |
|
CVE-2026-93343
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated at...
|
6.5 Medium | — | 0,40% | 22 Sep 2026 |
|
CVE-2026-93342
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated att...
|
5.4 Medium | — | 0,32% | 22 Sep 2026 |
|
CVE-2026-93341
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers...
|
4.3 Medium | — | 0,33% | 22 Sep 2026 |
|
CVE-2026-12718
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL I...
|
9.8 Critical | — | 0,32% | 22 Sep 2026 |
|
CVE-2026-95661
MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segmen...
|
5.1 Medium | — | 0,44% | 22 Sep 2026 |
|
CVE-2026-95659
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter...
|
4.8 Medium | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-95658
MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions...
|
6.9 Medium | — | 0,27% | 22 Sep 2026 |
|
CVE-2026-95619
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to...
|
7.7 High | — | 0,36% | 22 Sep 2026 |
|
CVE-2026-95273
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py of the com...
|
4.3 Medium | — | 0,52% | 22 Sep 2026 |
|
CVE-2026-95272
A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_content of the file changedetectionio/flask_app.py of the componen...
|
3.7 Low | — | 0,67% | 22 Sep 2026 |
|
CVE-2026-95271
A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function check_authentication of the file changedetectionio/flask_...
|
7.3 High | — | 0,65% | 22 Sep 2026 |
|
CVE-2026-93616
Advisory
checkpoint multi-domain security management
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
|
9.8 Critical | KEV | 75,9% | 22 Sep 2026 |
|
CVE-2026-75791
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.
|
8.6 High | — | 1,8% | 22 Sep 2026 |
|
CVE-2026-95270
A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the c...
|
3.7 Low | — | 0,44% | 22 Sep 2026 |
|
CVE-2026-89420
Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.
MPP.Ses...
|
7.1 High | — | 0,41% | 22 Sep 2026 |
|
CVE-2026-87119
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly.
The payer...
|
8.2 High | — | 0,57% | 22 Sep 2026 |
|
CVE-2026-74849
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.
|
9.8 Critical | — | 4,6% | 22 Sep 2026 |
|
CVE-2026-63279
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette inde...
|
5.4 Medium | — | 0,15% | 22 Sep 2026 |
|
CVE-2026-63278
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening...
|
6.7 Medium | — | 0,14% | 22 Sep 2026 |
|
CVE-2026-63276
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buf...
|
5.4 Medium | — | 0,19% | 22 Sep 2026 |
|
CVE-2026-63275
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked aga...
|
5.4 Medium | — | 0,19% | 22 Sep 2026 |
|
CVE-2026-63274
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own diction...
|
5.4 Medium | — | 0,19% | 22 Sep 2026 |
|
CVE-2026-63273
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the docume...
|
5.4 Medium | — | 0,12% | 22 Sep 2026 |
|
CVE-2026-63272
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advanc...
|
5.4 Medium | — | 0,20% | 22 Sep 2026 |
|
CVE-2026-95623
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds wit...
|
5.6 Medium | — | 0,24% | 22 Sep 2026 |
|
CVE-2026-92882
Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an a...
|
5.3 Medium | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-90990
Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional L...
|
5.3 Medium | — | 0,42% | 22 Sep 2026 |
|
CVE-2026-94117
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injec...
|
7.6 High | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-90882
The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticate...
|
8.7 High | — | 0,44% | 22 Sep 2026 |
|
CVE-2026-25265
qualcomm software center
Privilege escalation due to weak configuration while temporary file handling.
|
8.8 High | — | 0,08% | 22 Sep 2026 |
|
CVE-2026-25264
qualcomm software center
Privilege escalation due to weak configuration during package extraction process.
|
8.8 High | — | 0,08% | 22 Sep 2026 |
|
CVE-2026-25262
qualcomm mdm9207 firmware, qualcomm mdm9655 firmware +6 lainnya
Memory corruption while processing a crafted ELF file in the Primary Bootloader.
|
6.3 Medium | — | 0,14% | 22 Sep 2026 |