Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-73512
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches th...
|
7.5 High | — | 0,87% | 21 Sep 2026 |
|
CVE-2026-62247
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension p...
|
6.5 Medium | — | 0,45% | 21 Sep 2026 |
|
CVE-2026-58271
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials...
|
6.8 Medium | — | 0,22% | 21 Sep 2026 |
|
CVE-2026-58269
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with usernam...
|
8.1 High | — | 0,22% | 21 Sep 2026 |
|
CVE-2026-55897
luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform r...
|
8.8 High | — | 0,65% | 21 Sep 2026 |
|
CVE-2026-55159
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fas...
|
8.8 High | — | 0,49% | 21 Sep 2026 |
|
CVE-2026-54915
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes f...
|
5.4 Medium | — | 0,26% | 21 Sep 2026 |
|
CVE-2026-52835
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database...
|
7.0 High | — | 0,59% | 21 Sep 2026 |
|
CVE-2026-50572
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization c...
|
5.9 Medium | — | 0,68% | 21 Sep 2026 |
|
CVE-2026-49995
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by d...
|
4.8 Medium | — | 0,60% | 21 Sep 2026 |
|
CVE-2026-49811
Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with lo...
|
8.4 High | — | 0,14% | 21 Sep 2026 |
|
CVE-2026-48521
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::al...
|
5.9 Medium | — | 0,74% | 21 Sep 2026 |
|
CVE-2026-45381
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a Ja...
|
5.1 Medium | — | 0,57% | 21 Sep 2026 |
|
CVE-2026-94501
jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authoriz...
|
8.8 High | — | 0,55% | 21 Sep 2026 |
|
CVE-2026-94497
jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, an...
|
8.3 High | — | 0,46% | 21 Sep 2026 |
|
CVE-2026-94496
jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attack...
|
8.3 High | — | 0,46% | 21 Sep 2026 |
|
CVE-2026-94495
jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuratio...
|
7.1 High | — | 0,44% | 21 Sep 2026 |
|
CVE-2026-94494
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Atta...
|
5.0 Medium | — | 0,37% | 21 Sep 2026 |
|
CVE-2026-94414
jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission defi...
|
5.4 Medium | — | 0,38% | 21 Sep 2026 |
|
CVE-2026-94413
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attack...
|
6.5 Medium | — | 0,55% | 21 Sep 2026 |
|
CVE-2026-94412
jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password....
|
8.8 High | — | 0,55% | 21 Sep 2026 |
|
CVE-2026-94411
jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles....
|
8.8 High | — | 0,52% | 21 Sep 2026 |
|
CVE-2026-94403
A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library ene.sys of the component IOCTL Handler. This manipu...
|
8.8 High | — | 0,18% | 21 Sep 2026 |
|
CVE-2026-91167
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in...
|
6.0 Medium | — | 0,41% | 21 Sep 2026 |
|
CVE-2026-91166
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent:...
|
5.7 Medium | — | 0,22% | 21 Sep 2026 |
|
CVE-2026-91165
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso...
|
2.4 Low | — | 0,40% | 21 Sep 2026 |
|
CVE-2026-91164
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_toke...
|
4.3 Medium | — | 0,42% | 21 Sep 2026 |
|
CVE-2026-82165
Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local...
|
5.5 Medium | — | 0,13% | 21 Sep 2026 |
|
CVE-2026-82163
Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could...
|
5.5 Medium | — | 0,13% | 21 Sep 2026 |
|
CVE-2026-63330
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects...
|
7.7 High | — | 0,45% | 21 Sep 2026 |
|
CVE-2026-63329
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supp...
|
4.9 Medium | — | 0,31% | 21 Sep 2026 |
|
CVE-2026-61749
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rende...
|
6.5 Medium | — | 0,48% | 21 Sep 2026 |
|
CVE-2026-61748
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require au...
|
4.3 Medium | — | 0,42% | 21 Sep 2026 |
|
CVE-2026-61747
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataIm...
|
4.3 Medium | — | 0,34% | 21 Sep 2026 |
|
CVE-2026-61746
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions wi...
|
5.3 Medium | — | 0,40% | 21 Sep 2026 |
|
CVE-2026-61744
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase m...
|
6.5 Medium | — | 0,51% | 21 Sep 2026 |
|
CVE-2026-58491
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controll...
|
9.3 Critical | — | 0,46% | 21 Sep 2026 |
|
CVE-2026-49810
Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker wit...
|
7.8 High | — | 0,16% | 21 Sep 2026 |
|
CVE-2026-17052
The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object a...
|
7.8 High | — | 0,12% | 21 Sep 2026 |
|
CVE-2026-94488
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exp...
|
8.2 High | — | 0,14% | 21 Sep 2026 |
|
CVE-2026-93012
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell...
|
9.8 Critical | — | 0,60% | 21 Sep 2026 |
|
CVE-2026-92382
An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently un...
|
4.1 Medium | — | 0,14% | 21 Sep 2026 |
|
CVE-2026-69190
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with e...
|
6.3 Medium | — | 0,42% | 21 Sep 2026 |
|
CVE-2026-62369
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1...
|
8.1 High | — | 0,62% | 21 Sep 2026 |
|
CVE-2026-62182
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1...
|
8.8 High | — | 0,48% | 21 Sep 2026 |
|
CVE-2026-61745
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthe...
|
4.3 Medium | — | 0,43% | 21 Sep 2026 |
|
CVE-2026-61612
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2026-33060, extended for CVE-20...
|
5.7 Medium | — | 0,23% | 21 Sep 2026 |
|
CVE-2026-55473
HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/s...
|
6.0 Medium | — | 0,41% | 21 Sep 2026 |
|
CVE-2026-48976
HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through...
|
8.1 High | — | 0,45% | 21 Sep 2026 |
|
CVE-2026-48975
HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/rep...
|
8.1 High | — | 0,49% | 21 Sep 2026 |