Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-88410
The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.
|
7.1 High | — | 0,32% | 21 Sep 2026 |
|
CVE-2026-88409
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allow...
|
8.8 High | — | 0,48% | 21 Sep 2026 |
|
CVE-2026-88408
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attacke...
|
6.5 Medium | — | 0,41% | 21 Sep 2026 |
|
CVE-2026-88407
An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (...
|
7.5 High | — | 0,46% | 21 Sep 2026 |
|
CVE-2026-88406
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability...
|
7.5 High | — | 0,46% | 21 Sep 2026 |
|
CVE-2026-88405
A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows at...
|
9.8 Critical | — | 0,75% | 21 Sep 2026 |
|
CVE-2026-88404
A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows at...
|
9.8 Critical | — | 0,75% | 21 Sep 2026 |
|
CVE-2026-88403
A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP reques...
|
6.5 Medium | — | 0,40% | 21 Sep 2026 |
|
CVE-2026-88402
A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements.
|
9.8 Critical | — | 0,47% | 21 Sep 2026 |
|
CVE-2026-79919
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes.CDLL from a...
|
6.3 Medium | — | 0,39% | 21 Sep 2026 |
|
CVE-2026-79918
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execveat to prevent subpr...
|
6.3 Medium | — | 0,36% | 21 Sep 2026 |
|
CVE-2026-79917
MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a conversation e...
|
6.5 Medium | — | 0,27% | 21 Sep 2026 |
|
CVE-2026-79916
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and...
|
9.1 Critical | — | 0,45% | 21 Sep 2026 |
|
CVE-2026-79317
A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be...
|
4.8 Medium | — | 0,29% | 21 Sep 2026 |
|
CVE-2026-79316
An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and...
|
7.6 High | — | 0,32% | 21 Sep 2026 |
|
CVE-2026-77525
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load records using glo...
|
4.2 Medium | — | 0,19% | 21 Sep 2026 |
|
CVE-2026-77523
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.M...
|
7.4 High | — | 0,26% | 21 Sep 2026 |
|
CVE-2026-77522
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authentica...
|
4.3 Medium | — | 0,30% | 21 Sep 2026 |
|
CVE-2026-77521
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, whi...
|
10.0 Critical | — | 1,0% | 21 Sep 2026 |
|
CVE-2026-77520
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id from the home...
|
5.4 Medium | — | 0,23% | 21 Sep 2026 |
|
CVE-2026-77519
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret...
|
5.4 Medium | — | 0,24% | 21 Sep 2026 |
|
CVE-2026-77518
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same workspace...
|
5.0 Medium | — | 0,27% | 21 Sep 2026 |
|
CVE-2026-77517
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the reque...
|
5.4 Medium | — | 0,23% | 21 Sep 2026 |
|
CVE-2026-77516
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePerm...
|
5.4 Medium | — | 0,24% | 21 Sep 2026 |
|
CVE-2026-73553
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_m...
|
7.5 High | — | 0,51% | 21 Sep 2026 |
|
CVE-2026-73551
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not re...
|
5.3 Medium | — | 0,53% | 21 Sep 2026 |
|
CVE-2026-73511
envoyproxy envoy
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw reques...
|
5.3 Medium | — | 0,38% | 21 Sep 2026 |
|
CVE-2026-67827
Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to...
|
9.8 Critical | — | 0,75% | 21 Sep 2026 |
|
CVE-2026-61647
NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through...
|
7.1 High | — | 0,32% | 21 Sep 2026 |
|
CVE-2026-59816
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transc...
|
4.3 Medium | — | 0,36% | 21 Sep 2026 |
|
CVE-2026-58272
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the l...
|
5.3 Medium | — | 0,34% | 21 Sep 2026 |
|
CVE-2026-58270
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied s...
|
6.5 Medium | — | 0,35% | 21 Sep 2026 |
|
CVE-2026-55179
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in...
|
6.5 Medium | — | 0,26% | 21 Sep 2026 |
|
CVE-2026-55105
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/foun...
|
7.7 High | — | 0,50% | 21 Sep 2026 |
|
CVE-2026-49453
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource...
|
7.0 High | — | 0,41% | 21 Sep 2026 |
|
CVE-2026-49450
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName f...
|
7.1 High | — | 0,18% | 21 Sep 2026 |
|
CVE-2026-49449
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.t...
|
2.5 Low | — | 0,20% | 21 Sep 2026 |
|
CVE-2026-46649
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id end...
|
9.1 Critical | — | 0,50% | 21 Sep 2026 |
|
CVE-2026-85219
Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.
|
3.7 Low | — | 0,41% | 21 Sep 2026 |
|
CVE-2026-81469
Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could pot...
|
7.8 High | — | 0,19% | 21 Sep 2026 |
|
CVE-2026-79320
Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fi...
|
6.1 Medium | — | 0,16% | 21 Sep 2026 |
|
CVE-2026-79319
Stencil core 4.43.5 is vulnerable to Incorrect Access Control.
|
5.3 Medium | — | 0,21% | 21 Sep 2026 |
|
CVE-2026-79318
web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/web...
|
6.5 Medium | — | 0,56% | 21 Sep 2026 |
|
CVE-2026-73552
envoyproxy envoy
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opa...
|
7.5 High | — | 0,47% | 21 Sep 2026 |
|
CVE-2026-73550
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Hos...
|
7.5 High | — | 0,55% | 21 Sep 2026 |
|
CVE-2026-73549
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressA...
|
5.3 Medium | — | 0,62% | 21 Sep 2026 |
|
CVE-2026-73548
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured...
|
7.5 High | — | 0,46% | 21 Sep 2026 |
|
CVE-2026-73547
envoyproxy envoy
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that...
|
7.5 High | — | 0,55% | 21 Sep 2026 |
|
CVE-2026-73546
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endp...
|
7.4 High | — | 0,62% | 21 Sep 2026 |
|
CVE-2026-73513
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTT...
|
7.5 High | — | 0,48% | 21 Sep 2026 |