Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-81653
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users g...
|
4.2 Medium | — | 0,19% | 20 Sep 2026 |
|
CVE-2026-81652
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it,...
|
2.7 Low | — | 0,30% | 20 Sep 2026 |
|
CVE-2026-81651
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-man...
|
3.1 Low | — | 0,21% | 20 Sep 2026 |
|
CVE-2026-81650
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a...
|
7.2 High | — | 0,50% | 20 Sep 2026 |
|
CVE-2026-16542
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowi...
|
4.1 Medium | — | 0,18% | 20 Sep 2026 |
|
CVE-2026-14844
The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which...
|
6.8 Medium | — | 0,24% | 20 Sep 2026 |
|
CVE-2026-93965
A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Man...
|
6.6 Medium | — | 1,9% | 20 Sep 2026 |
|
CVE-2026-93964
A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/ce...
|
5.3 Medium | — | 0,45% | 20 Sep 2026 |
|
CVE-2026-93963
A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/controller.php. Th...
|
6.3 Medium | — | 0,33% | 20 Sep 2026 |
|
CVE-2026-93962
A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of t...
|
8.3 High | — | 0,69% | 20 Sep 2026 |
|
CVE-2026-93961
A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/co...
|
5.3 Medium | — | 0,58% | 20 Sep 2026 |
|
CVE-2026-93960
A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component...
|
4.3 Medium | — | 0,58% | 20 Sep 2026 |
|
CVE-2026-86553
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authenticat...
|
8.8 High | — | 0,52% | 20 Sep 2026 |
|
CVE-2026-86552
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentia...
|
5.4 Medium | — | 0,36% | 20 Sep 2026 |
|
CVE-2026-93959
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessme...
|
7.3 High | — | 0,43% | 20 Sep 2026 |
|
CVE-2026-94084
oisf suricata
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
|
9.4 Critical | — | 0,54% | 20 Sep 2026 |
|
CVE-2026-94083
oisf suricata
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1...
|
9.4 Critical | — | 0,54% | 20 Sep 2026 |
|
CVE-2026-93958
A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of t...
|
9.1 Critical | — | 2,7% | 20 Sep 2026 |
|
CVE-2026-93957
A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the comp...
|
4.3 Medium | — | 0,49% | 20 Sep 2026 |
|
CVE-2026-86551
The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_addres...
|
3.3 Low | — | 0,19% | 20 Sep 2026 |
|
CVE-2026-94057
exim
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during...
|
5.3 Medium | — | 0,20% | 19 Sep 2026 |
|
CVE-2026-94056
exim
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
|
7.5 High | — | 0,24% | 19 Sep 2026 |
|
CVE-2026-94055
exim
Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
|
5.3 Medium | — | 0,29% | 19 Sep 2026 |
|
CVE-2026-94054
exim
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
|
5.3 Medium | — | 0,27% | 19 Sep 2026 |
|
CVE-2026-93993
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can...
|
8.8 High | — | 0,77% | 19 Sep 2026 |
|
CVE-2026-93992
Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory....
|
8.1 High | — | 0,91% | 19 Sep 2026 |
|
CVE-2026-93991
Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when t...
|
7.7 High | — | 0,44% | 19 Sep 2026 |
|
CVE-2026-93990
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers c...
|
7.5 High | — | 0,40% | 19 Sep 2026 |
|
CVE-2026-93989
vllm
vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers ca...
|
4.3 Medium | — | 0,20% | 19 Sep 2026 |
|
CVE-2026-93988
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary f...
|
6.5 Medium | — | 0,55% | 19 Sep 2026 |
|
CVE-2026-93956
A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the comp...
|
3.5 Low | — | 0,42% | 19 Sep 2026 |
|
CVE-2026-93955
A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/mai...
|
4.3 Medium | — | 0,41% | 19 Sep 2026 |
|
CVE-2026-93954
A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/...
|
4.3 Medium | — | 0,39% | 19 Sep 2026 |
|
CVE-2026-82672
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a str...
|
6.3 Medium | — | 0,52% | 19 Sep 2026 |
|
CVE-2026-82560
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.
Each =over...
|
7.5 High | — | 0,63% | 19 Sep 2026 |
|
CVE-2026-94001
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not corre...
|
6.5 Medium | — | 0,44% | 19 Sep 2026 |
|
CVE-2026-94000
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the s...
|
6.6 Medium | — | 0,40% | 19 Sep 2026 |
|
CVE-2026-93999
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh proces...
|
4.2 Medium | — | 0,23% | 19 Sep 2026 |
|
CVE-2026-93987
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go compute...
|
3.4 Low | — | 0,15% | 19 Sep 2026 |
|
CVE-2026-93986
rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Atta...
|
3.1 Low | — | 0,29% | 19 Sep 2026 |
|
CVE-2026-93985
OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to cons...
|
9.9 Critical | — | 0,67% | 19 Sep 2026 |
|
CVE-2026-93984
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public cl...
|
5.3 Medium | — | 0,42% | 19 Sep 2026 |
|
CVE-2026-93983
OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted fi...
|
5.0 Medium | — | 0,33% | 19 Sep 2026 |
|
CVE-2026-93982
OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with acce...
|
3.3 Low | — | 0,17% | 19 Sep 2026 |
|
CVE-2026-93981
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronou...
|
4.7 Medium | — | 0,23% | 19 Sep 2026 |
|
CVE-2026-78030
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.
DBD::DBM passes the dbm_type and dbm_mldbm conne...
|
9.8 Critical | — | 0,42% | 19 Sep 2026 |
|
CVE-2026-9858
The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_ord...
|
4.3 Medium | — | 0,35% | 19 Sep 2026 |
|
CVE-2026-9766
The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly v...
|
4.3 Medium | — | 0,40% | 19 Sep 2026 |
|
CVE-2026-9613
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the...
|
4.3 Medium | — | 0,60% | 19 Sep 2026 |
|
CVE-2026-93742
A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the...
|
9.9 Critical | — | 2,3% | 19 Sep 2026 |