Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-94381
MISP has a security issue that can let a user gain more access than their API key is supposed to allow.
A read-only API key should only let someone view information. How...
|
8.7 High | — | 0,37% | 21 Sep 2026 |
|
CVE-2026-94379
The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allow...
|
6.9 Medium | — | 0,58% | 21 Sep 2026 |
|
CVE-2026-94374
MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterat...
|
8.3 High | — | 0,37% | 21 Sep 2026 |
|
CVE-2026-94373
MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option> elements...
|
6.3 Medium | — | 0,39% | 21 Sep 2026 |
|
CVE-2026-94372
MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy...
|
6.3 Medium | — | 0,39% | 21 Sep 2026 |
|
CVE-2026-94216
A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Han...
|
4.3 Medium | — | 0,45% | 21 Sep 2026 |
|
CVE-2026-94214
A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of t...
|
4.3 Medium | — | 0,43% | 21 Sep 2026 |
|
CVE-2026-94211
A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade....
|
2.4 Low | — | 0,35% | 21 Sep 2026 |
|
CVE-2026-84285
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.
|
8.8 High | — | 1,8% | 21 Sep 2026 |
|
CVE-2026-94368
A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service process...
|
7.1 High | — | 0,23% | 21 Sep 2026 |
|
CVE-2026-94210
A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of t...
|
3.5 Low | — | 0,36% | 21 Sep 2026 |
|
CVE-2026-91867
apache neethi
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive i...
|
4.3 Medium | — | 0,50% | 21 Sep 2026 |
|
CVE-2026-91866
apache neethi
A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of servi...
|
7.5 High | — | 0,74% | 21 Sep 2026 |
|
CVE-2026-91865
apache neethi
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts o...
|
7.5 High | — | 0,74% | 21 Sep 2026 |
|
CVE-2026-91864
apache neethi
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits,...
|
7.5 High | — | 0,74% | 21 Sep 2026 |
|
CVE-2026-91863
apache neethi
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denia...
|
7.5 High | — | 0,76% | 21 Sep 2026 |
|
CVE-2026-89139
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to l...
|
8.7 High | — | 0,58% | 21 Sep 2026 |
|
CVE-2026-87858
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permissio...
|
7.2 High | — | 0,78% | 21 Sep 2026 |
|
CVE-2026-65654
github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those lim...
|
8.7 High | — | 0,58% | 21 Sep 2026 |
|
CVE-2026-65653
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its...
|
8.7 High | — | 0,71% | 21 Sep 2026 |
|
CVE-2026-65652
github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete...
|
8.7 High | — | 0,71% | 21 Sep 2026 |
|
CVE-2026-65651
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nes...
|
8.7 High | — | 0,67% | 21 Sep 2026 |
|
CVE-2026-16652
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create o...
|
7.1 High | — | 0,27% | 21 Sep 2026 |
|
CVE-2026-16651
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal...
|
8.7 High | — | 0,39% | 21 Sep 2026 |
|
CVE-2026-92612
In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes in...
|
1.0 Low | — | 0,15% | 21 Sep 2026 |
|
CVE-2026-77021
Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registe...
|
5.3 Medium | — | 0,38% | 21 Sep 2026 |
|
CVE-2026-94277
MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encodin...
|
6.3 Medium | — | 0,40% | 21 Sep 2026 |
|
CVE-2026-92574
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security conte...
|
8.8 High | — | 0,65% | 21 Sep 2026 |
|
CVE-2026-91921
Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated...
|
5.1 Medium | — | 0,60% | 21 Sep 2026 |
|
CVE-2026-94152
A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Pro...
|
4.3 Medium | — | 0,37% | 21 Sep 2026 |
|
CVE-2026-94151
A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Per...
|
5.3 Medium | — | 0,68% | 21 Sep 2026 |
|
CVE-2026-94150
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG Fil...
|
2.4 Low | — | 0,35% | 21 Sep 2026 |
|
CVE-2026-92400
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured...
|
5.3 Medium | — | 0,16% | 21 Sep 2026 |
|
CVE-2026-86802
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imp...
|
3.7 Low | — | 0,25% | 21 Sep 2026 |
|
CVE-2026-85113
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode strippi...
|
6.5 Medium | — | 0,31% | 21 Sep 2026 |
|
CVE-2026-85010
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, all...
|
5.3 Medium | — | 0,32% | 21 Sep 2026 |
|
CVE-2026-15801
A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insuf...
|
8.0 High | — | 0,32% | 21 Sep 2026 |
|
CVE-2025-12999
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefi...
|
9.1 Critical | — | 0,34% | 21 Sep 2026 |
|
CVE-2026-94149
A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the compone...
|
4.3 Medium | — | 0,38% | 21 Sep 2026 |
|
CVE-2026-94148
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export P...
|
5.3 Medium | — | 0,54% | 21 Sep 2026 |
|
CVE-2026-47321
The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and cr...
|
7.5 High | — | 0,49% | 21 Sep 2026 |
|
CVE-2026-94218
A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stron...
|
3.1 Low | — | 0,31% | 21 Sep 2026 |
|
CVE-2026-94217
A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If...
|
3.5 Low | — | 0,24% | 21 Sep 2026 |
|
CVE-2026-94215
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory...
|
5.5 Medium | — | 0,30% | 21 Sep 2026 |
|
CVE-2026-94213
A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation en...
|
4.9 Medium | — | 0,39% | 21 Sep 2026 |
|
CVE-2026-94146
A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. Th...
|
8.8 High | — | 0,18% | 21 Sep 2026 |
|
CVE-2026-94145
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/bus...
|
3.5 Low | — | 0,33% | 21 Sep 2026 |
|
CVE-2026-94144
A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executin...
|
7.3 High | — | 0,43% | 21 Sep 2026 |
|
CVE-2026-90860
The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control...
|
7.1 High | — | 0,31% | 21 Sep 2026 |
|
CVE-2026-82187
The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to...
|
9.8 Critical | — | 0,55% | 21 Sep 2026 |