Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-82165
Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local...
|
5.5 Medium | — | 0,13% | 21 Sep 2026 |
|
CVE-2026-82163
Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could...
|
5.5 Medium | — | 0,13% | 21 Sep 2026 |
|
CVE-2026-63330
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects...
|
7.7 High | — | 0,45% | 21 Sep 2026 |
|
CVE-2026-63329
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supp...
|
4.9 Medium | — | 0,31% | 21 Sep 2026 |
|
CVE-2026-61749
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rende...
|
6.5 Medium | — | 0,48% | 21 Sep 2026 |
|
CVE-2026-61748
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require au...
|
4.3 Medium | — | 0,42% | 21 Sep 2026 |
|
CVE-2026-61747
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataIm...
|
4.3 Medium | — | 0,34% | 21 Sep 2026 |
|
CVE-2026-61746
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions wi...
|
5.3 Medium | — | 0,40% | 21 Sep 2026 |
|
CVE-2026-61744
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase m...
|
6.5 Medium | — | 0,51% | 21 Sep 2026 |
|
CVE-2026-58491
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controll...
|
9.3 Critical | — | 0,46% | 21 Sep 2026 |
|
CVE-2026-49810
Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker wit...
|
7.8 High | — | 0,16% | 21 Sep 2026 |
|
CVE-2026-17052
The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object a...
|
7.8 High | — | 0,12% | 21 Sep 2026 |
|
CVE-2026-94488
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exp...
|
8.2 High | — | 0,14% | 21 Sep 2026 |
|
CVE-2026-93012
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell...
|
9.8 Critical | — | 0,60% | 21 Sep 2026 |
|
CVE-2026-92382
An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently un...
|
4.1 Medium | — | 0,14% | 21 Sep 2026 |
|
CVE-2026-69190
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with e...
|
6.3 Medium | — | 0,42% | 21 Sep 2026 |
|
CVE-2026-62369
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1...
|
8.1 High | — | 0,62% | 21 Sep 2026 |
|
CVE-2026-62182
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1...
|
8.8 High | — | 0,48% | 21 Sep 2026 |
|
CVE-2026-61745
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthe...
|
4.3 Medium | — | 0,43% | 21 Sep 2026 |
|
CVE-2026-61612
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2026-33060, extended for CVE-20...
|
5.7 Medium | — | 0,23% | 21 Sep 2026 |
|
CVE-2026-55473
HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/s...
|
6.0 Medium | — | 0,41% | 21 Sep 2026 |
|
CVE-2026-48976
HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through...
|
8.1 High | — | 0,45% | 21 Sep 2026 |
|
CVE-2026-48975
HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/rep...
|
8.1 High | — | 0,49% | 21 Sep 2026 |
|
CVE-2026-48974
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-suppl...
|
5.4 Medium | — | 0,29% | 21 Sep 2026 |
|
CVE-2026-48826
HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1/actions/wi...
|
8.1 High | — | 0,49% | 21 Sep 2026 |
|
CVE-2026-94449
A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue oc...
|
7.5 High | — | 0,63% | 21 Sep 2026 |
|
CVE-2026-84990
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lu...
|
8.8 High | — | 0,33% | 21 Sep 2026 |
|
CVE-2026-83621
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edi...
|
8.1 High | — | 0,53% | 21 Sep 2026 |
|
CVE-2026-79920
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlug...
|
9.9 Critical | — | 0,62% | 21 Sep 2026 |
|
CVE-2026-77582
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for exist...
|
6.9 Medium | — | 0,48% | 21 Sep 2026 |
|
CVE-2026-77561
Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexi...
|
5.3 Medium | — | 0,60% | 21 Sep 2026 |
|
CVE-2026-77560
Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent host...
|
8.1 High | — | 0,61% | 21 Sep 2026 |
|
CVE-2026-76898
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Address...
|
7.7 High | — | 0,35% | 21 Sep 2026 |
|
CVE-2026-63416
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPat...
|
3.7 Low | — | 0,33% | 21 Sep 2026 |
|
CVE-2026-63373
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java...
|
4.2 Medium | — | 0,15% | 21 Sep 2026 |
|
CVE-2026-63334
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request...
|
6.8 Medium | — | 0,32% | 21 Sep 2026 |
|
CVE-2026-63116
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valv...
|
8.8 High | — | 0,51% | 21 Sep 2026 |
|
CVE-2026-62987
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeade...
|
5.8 Medium | — | 0,20% | 21 Sep 2026 |
|
CVE-2026-62866
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advan...
|
6.2 Medium | — | 0,19% | 21 Sep 2026 |
|
CVE-2026-62371
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1...
|
8.8 High | — | 0,49% | 21 Sep 2026 |
|
CVE-2026-62370
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1,...
|
6.5 Medium | — | 0,50% | 21 Sep 2026 |
|
CVE-2026-61674
Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure...
|
9.2 Critical | — | 0,72% | 21 Sep 2026 |
|
CVE-2026-59168
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, deco...
|
6.2 Medium | — | 0,13% | 21 Sep 2026 |
|
CVE-2026-58504
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled...
|
6.1 Medium | — | 0,25% | 21 Sep 2026 |
|
CVE-2026-17051
The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-written doorbe...
|
6.0 Medium | — | 0,11% | 21 Sep 2026 |
|
CVE-2026-17050
The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuratio...
|
5.7 Medium | — | 0,16% | 21 Sep 2026 |
|
CVE-2026-88978
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repositor...
|
4.3 Medium | — | 0,28% | 21 Sep 2026 |
|
CVE-2026-85751
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST...
|
9.8 Critical | — | 0,56% | 21 Sep 2026 |
|
CVE-2026-84298
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supp...
|
3.1 Low | — | 0,24% | 21 Sep 2026 |
|
CVE-2026-82412
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/l...
|
8.8 High | — | 0,65% | 21 Sep 2026 |