Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-94492
A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the compo...
|
6.3 Medium | — | 0,32% | 22 Sep 2026 |
|
CVE-2026-94491
A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulation of the argument address ca...
|
7.3 High | — | 0,41% | 22 Sep 2026 |
|
CVE-2026-93712
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler.
The handler joins the request...
|
7.5 High | — | 0,55% | 22 Sep 2026 |
|
CVE-2026-93711
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array.
The routine removes CR and LF from each header value but no...
|
6.5 Medium | — | 0,37% | 22 Sep 2026 |
|
CVE-2026-93710
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks.
A hook that...
|
7.5 High | — | 0,63% | 22 Sep 2026 |
|
CVE-2026-93709
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler.
The handler compares th...
|
5.3 Medium | — | 0,33% | 22 Sep 2026 |
|
CVE-2026-76974
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authen...
|
5.3 Medium | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-94426
A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument...
|
3.5 Low | — | 0,33% | 21 Sep 2026 |
|
CVE-2026-94425
A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub_140006F0C in the library mtdispkm64.sys of the compone...
|
8.8 High | — | 0,16% | 21 Sep 2026 |
|
CVE-2026-94627
vllm
vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode d...
|
7.5 High | — | 0,63% | 21 Sep 2026 |
|
CVE-2026-94626
vllm
vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memo...
|
7.5 High | — | 0,63% | 21 Sep 2026 |
|
CVE-2026-94625
vllm
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are neve...
|
5.3 Medium | — | 0,52% | 21 Sep 2026 |
|
CVE-2026-94624
vllm
vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer s...
|
7.5 High | — | 0,63% | 21 Sep 2026 |
|
CVE-2026-94623
vllm
vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across m...
|
7.5 High | — | 0,63% | 21 Sep 2026 |
|
CVE-2026-94622
vllm
vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers c...
|
7.5 High | — | 0,63% | 21 Sep 2026 |
|
CVE-2026-94540
DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attack...
|
7.7 High | — | 0,16% | 21 Sep 2026 |
|
CVE-2026-94536
lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles a...
|
4.3 Medium | — | 0,34% | 21 Sep 2026 |
|
CVE-2026-94535
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notificatio...
|
7.1 High | — | 0,47% | 21 Sep 2026 |
|
CVE-2026-94534
lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary u...
|
7.1 High | — | 0,49% | 21 Sep 2026 |
|
CVE-2026-94533
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attack...
|
6.5 Medium | — | 0,44% | 21 Sep 2026 |
|
CVE-2026-94532
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full pro...
|
6.5 Medium | — | 0,44% | 21 Sep 2026 |
|
CVE-2026-93340
Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens fo...
|
6.8 Medium | — | 0,53% | 21 Sep 2026 |
|
CVE-2026-88756
Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authent...
|
5.3 Medium | — | 0,22% | 21 Sep 2026 |
|
CVE-2026-88738
Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administrative privi...
|
8.8 High | — | 0,61% | 21 Sep 2026 |
|
CVE-2026-79079
An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components
|
7.8 High | — | 0,19% | 21 Sep 2026 |
|
CVE-2026-78847
An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript....
|
9.8 Critical | — | 0,60% | 21 Sep 2026 |
|
CVE-2026-78806
An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformComm...
|
5.5 Medium | — | 0,11% | 21 Sep 2026 |
|
CVE-2026-65980
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse prot...
|
7.9 High | — | 0,46% | 21 Sep 2026 |
|
CVE-2026-61852
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() impl...
|
5.8 Medium | — | 0,36% | 21 Sep 2026 |
|
CVE-2026-61851
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() impl...
|
6.5 Medium | — | 0,47% | 21 Sep 2026 |
|
CVE-2026-61743
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/...
|
6.3 Medium | — | 0,40% | 21 Sep 2026 |
|
CVE-2026-61652
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed resp...
|
8.7 High | — | 0,44% | 21 Sep 2026 |
|
CVE-2026-61541
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redir...
|
6.9 Medium | — | 0,43% | 21 Sep 2026 |
|
CVE-2026-59830
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them int...
|
5.4 Medium | — | 0,29% | 21 Sep 2026 |
|
CVE-2026-59815
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() autho...
|
4.3 Medium | — | 0,23% | 21 Sep 2026 |
|
CVE-2026-59814
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= rou...
|
7.6 High | — | 0,35% | 21 Sep 2026 |
|
CVE-2026-55210
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an...
|
7.4 High | — | 0,48% | 21 Sep 2026 |
|
CVE-2026-46650
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.t...
|
4.4 Medium | — | 0,28% | 21 Sep 2026 |
|
CVE-2026-17054
The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For control frames...
|
5.3 Medium | — | 0,17% | 21 Sep 2026 |
|
CVE-2026-15890
The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/src/its/tran...
|
5.3 Medium | — | 0,06% | 21 Sep 2026 |
|
CVE-2026-94588
In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied inpu...
|
4.4 Medium | — | 0,25% | 21 Sep 2026 |
|
CVE-2026-94572
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verb...
|
9.4 Critical | — | 0,53% | 21 Sep 2026 |
|
CVE-2026-94571
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 U...
|
9.4 Critical | — | 0,53% | 21 Sep 2026 |
|
CVE-2026-94424
A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub_140001000 in the library mtdispkm64.sys of the componen...
|
8.8 High | — | 0,20% | 21 Sep 2026 |
|
CVE-2026-93433
A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface)...
|
5.5 Medium | — | 0,16% | 21 Sep 2026 |
|
CVE-2026-88746
idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.
|
7.1 High | — | 0,25% | 21 Sep 2026 |
|
CVE-2026-88745
EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.
|
6.1 Medium | — | 0,25% | 21 Sep 2026 |
|
CVE-2026-88467
CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive informat...
|
6.2 Medium | — | 0,12% | 21 Sep 2026 |
|
CVE-2026-88412
An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service (DoS) via...
|
5.3 Medium | — | 0,40% | 21 Sep 2026 |
|
CVE-2026-88411
Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the applicat...
|
7.5 High | — | 0,49% | 21 Sep 2026 |