Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-11727
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to impr...
|
8.1 High | — | 0,44% | 18 Sep 2026 |
|
CVE-2026-11726
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validatio...
|
8.1 High | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-11725
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.
|
8.8 High | — | 0,40% | 18 Sep 2026 |
|
CVE-2026-11722
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.
|
4.8 Medium | — | 0,18% | 18 Sep 2026 |
|
CVE-2026-11716
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manage...
|
7.5 High | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-11711
IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component.
|
6.5 Medium | — | 0,38% | 18 Sep 2026 |
|
CVE-2026-11710
IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers.
|
6.5 Medium | — | 0,23% | 18 Sep 2026 |
|
CVE-2026-11549
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability.
|
6.5 Medium | — | 0,23% | 18 Sep 2026 |
|
CVE-2026-11548
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.
|
4.8 Medium | — | 0,18% | 18 Sep 2026 |
|
CVE-2026-11545
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization ch...
|
3.7 Low | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-11540
IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.
|
5.3 Medium | — | 0,30% | 18 Sep 2026 |
|
CVE-2026-11539
IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector.
|
5.3 Medium | — | 0,30% | 18 Sep 2026 |
|
CVE-2017-20284
Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by suppl...
|
7.5 High | — | 0,96% | 18 Sep 2026 |
|
CVE-2026-93854
In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE...
|
7.2 High | — | 0,41% | 18 Sep 2026 |
|
CVE-2026-93852
In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-...
|
7.1 High | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-93650
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttli...
|
3.7 Low | — | 0,69% | 18 Sep 2026 |
|
CVE-2026-75894
In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and...
|
7.5 High | — | 0,31% | 18 Sep 2026 |
|
CVE-2026-75893
In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg() function via IPA frame lengths.
|
7.5 High | — | 0,46% | 18 Sep 2026 |
|
CVE-2026-75892
In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruptio...
|
6.5 Medium | — | 0,28% | 18 Sep 2026 |
|
CVE-2026-11538
ibm websphere application server
IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.
|
5.3 Medium | — | 0,16% | 18 Sep 2026 |
|
CVE-2023-54399
Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query wi...
|
9.8 Critical | — | 0,42% | 18 Sep 2026 |
|
CVE-2021-48008
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET paramete...
|
7.5 High | — | 0,34% | 18 Sep 2026 |
|
CVE-2019-25776
Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input throug...
|
7.5 High | — | 0,36% | 18 Sep 2026 |
|
CVE-2026-93764
mongodb mongoid
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feat...
|
6.5 Medium | — | 0,15% | 18 Sep 2026 |
|
CVE-2026-93763
mongodb mongoid
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-lev...
|
6.5 Medium | — | 0,15% | 18 Sep 2026 |
|
CVE-2026-93762
mongodb mongoid
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-m...
|
9.8 Critical | — | 0,57% | 18 Sep 2026 |
|
CVE-2026-93761
mongodb mongoid
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessiv...
|
7.5 High | — | 0,46% | 18 Sep 2026 |
|
CVE-2026-93760
mongodb mongoid
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an applica...
|
8.2 High | — | 0,53% | 18 Sep 2026 |
|
CVE-2026-93759
mongodb mongoid
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An...
|
8.6 High | — | 0,43% | 18 Sep 2026 |
|
CVE-2026-93753
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. A...
|
7.5 High | — | 0,51% | 18 Sep 2026 |
|
CVE-2026-93752
CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a...
|
7.5 High | — | 0,68% | 18 Sep 2026 |
|
CVE-2026-93751
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharact...
|
6.5 Medium | — | 0,40% | 18 Sep 2026 |
|
CVE-2026-93750
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to b...
|
5.9 Medium | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-93749
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers...
|
7.5 High | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-93748
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attacker...
|
7.5 High | — | 0,57% | 18 Sep 2026 |
|
CVE-2026-93432
A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type inform...
|
6.1 Medium | — | 0,54% | 18 Sep 2026 |
|
CVE-2026-92768
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by i...
|
5.5 Medium | — | 0,15% | 18 Sep 2026 |
|
CVE-2026-92747
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine...
|
5.0 Medium | — | 0,15% | 18 Sep 2026 |
|
CVE-2026-92745
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription...
|
5.0 Medium | — | 0,10% | 18 Sep 2026 |
|
CVE-2026-92702
Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifyAttestationReportTLS in the AMD SEV-SNP verifier sets Policy.ReportData only when...
|
9.1 Critical | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-92701
Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifTeeAttestation in the Intel TDX aTLS verifier receives an expected current-session...
|
9.1 Critical | — | 0,22% | 18 Sep 2026 |
|
CVE-2026-91127
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-...
|
8.2 High | — | 0,40% | 18 Sep 2026 |
|
CVE-2026-85058
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without in...
|
7.5 High | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-84992
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/C...
|
6.1 Medium | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-84975
PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib/src/pj/ssl_sock_ossl.c and pj...
|
7.4 High | — | 0,23% | 18 Sep 2026 |
|
CVE-2026-81182
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an...
|
4.2 Medium | — | 0,27% | 18 Sep 2026 |
|
CVE-2026-81181
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session id...
|
3.7 Low | — | 0,28% | 18 Sep 2026 |
|
CVE-2026-81180
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause i...
|
8.8 High | — | 0,66% | 18 Sep 2026 |
|
CVE-2026-81179
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a w...
|
8.1 High | — | 0,48% | 18 Sep 2026 |
|
CVE-2026-81178
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative...
|
3.5 Low | — | 0,30% | 18 Sep 2026 |