Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-77396
teluu pjsip
PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input...
|
7.1 High | — | 0,12% | 18 Sep 2026 |
|
CVE-2026-77386
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-c...
|
6.5 Medium | — | 0,56% | 18 Sep 2026 |
|
CVE-2026-77385
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded fil...
|
4.3 Medium | — | 0,34% | 18 Sep 2026 |
|
CVE-2026-71537
Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service:...
|
6.5 Medium | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-69186
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that t...
|
5.3 Medium | — | 0,52% | 18 Sep 2026 |
|
CVE-2026-69184
c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or...
|
7.5 High | — | 0,68% | 18 Sep 2026 |
|
CVE-2026-64847
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers wi...
|
6.8 Medium | — | 0,16% | 18 Sep 2026 |
|
CVE-2026-63458
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can s...
|
7.1 High | — | 0,30% | 18 Sep 2026 |
|
CVE-2026-63445
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the requ...
|
7.1 High | — | 0,56% | 18 Sep 2026 |
|
CVE-2026-63199
Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy p...
|
8.3 High | — | 0,27% | 18 Sep 2026 |
|
CVE-2026-62279
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled rec...
|
7.1 High | — | 0,40% | 18 Sep 2026 |
|
CVE-2026-62278
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach Handl...
|
8.1 High | — | 0,51% | 18 Sep 2026 |
|
CVE-2026-61552
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated conf...
|
7.2 High | — | 0,90% | 18 Sep 2026 |
|
CVE-2026-61551
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not boun...
|
8.6 High | — | 0,94% | 18 Sep 2026 |
|
CVE-2026-61550
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is...
|
9.8 Critical | — | 0,67% | 18 Sep 2026 |
|
CVE-2026-59163
Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and payload usin...
|
9.1 Critical | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-33625
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pyt...
|
8.8 High | — | 0,44% | 18 Sep 2026 |
|
CVE-2026-32641
Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x...
|
7.5 High | — | 0,92% | 18 Sep 2026 |
|
CVE-2025-66455
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/P...
|
9.8 Critical | — | 0,69% | 18 Sep 2026 |
|
CVE-2026-93765
mongodb mongoid
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthen...
|
9.1 Critical | — | 0,51% | 18 Sep 2026 |
|
CVE-2026-93758
mongodb mongoid
An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to referenc...
|
8.1 High | — | 0,36% | 18 Sep 2026 |
|
CVE-2026-93579
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into H...
|
6.5 Medium | — | 0,90% | 18 Sep 2026 |
|
CVE-2026-93559
A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/d...
|
7.3 High | — | 0,65% | 18 Sep 2026 |
|
CVE-2026-93534
A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Up...
|
6.3 Medium | — | 0,21% | 18 Sep 2026 |
|
CVE-2026-93533
A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app...
|
6.3 Medium | — | 1,4% | 18 Sep 2026 |
|
CVE-2026-93338
Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote attackers to obtain sensitive...
|
5.3 Medium | — | 0,53% | 18 Sep 2026 |
|
CVE-2026-91149
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cock...
|
7.5 High | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-91147
A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request....
|
5.9 Medium | — | 0,40% | 18 Sep 2026 |
|
CVE-2026-91142
A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit...
|
3.6 Low | — | 0,12% | 18 Sep 2026 |
|
CVE-2026-85497
CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attack...
|
9.8 Critical | — | 0,34% | 18 Sep 2026 |
|
CVE-2026-85478
A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication....
|
3.5 Low | — | 0,22% | 18 Sep 2026 |
|
CVE-2026-81505
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the...
|
7.1 High | — | 0,46% | 18 Sep 2026 |
|
CVE-2026-81321
CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical acce...
|
9.8 Critical | — | 0,34% | 18 Sep 2026 |
|
CVE-2026-77616
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, `Special:A...
|
6.1 Medium | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-77610
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, query debug output...
|
6.1 Medium | — | 0,28% | 18 Sep 2026 |
|
CVE-2026-77609
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `Special:URIResolve...
|
6.1 Medium | — | 0,27% | 18 Sep 2026 |
|
CVE-2026-77608
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the `value` pa...
|
6.1 Medium | — | 0,28% | 18 Sep 2026 |
|
CVE-2026-77607
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `sep` was inserted...
|
6.1 Medium | — | 0,28% | 18 Sep 2026 |
|
CVE-2026-77606
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when `headers=plain...
|
6.1 Medium | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-77339
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin req...
|
5.1 Medium | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-77301
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompre...
|
7.5 High | — | 0,61% | 18 Sep 2026 |
|
CVE-2026-77240
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/migrations/017_account_sharing...
|
9.9 Critical | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-77239
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce t...
|
8.1 High | — | 0,53% | 18 Sep 2026 |
|
CVE-2026-73863
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/protocol/mqtt/mqtt_parser.c reuses len_of_varint from...
|
7.0 High | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-63406
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracki...
|
5.9 Medium | — | 0,30% | 18 Sep 2026 |
|
CVE-2026-63405
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the...
|
5.9 Medium | — | 0,21% | 18 Sep 2026 |
|
CVE-2026-63349
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argum...
|
7.0 High | — | 0,11% | 18 Sep 2026 |
|
CVE-2026-62943
btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's ssh_filter_btrbk.sh constructs allow_stream_match with a...
|
8.7 High | — | 0,50% | 18 Sep 2026 |
|
CVE-2026-61833
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pk...
|
8.1 High | — | 0,51% | 18 Sep 2026 |
|
CVE-2026-61795
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostna...
|
6.8 Medium | — | 0,59% | 18 Sep 2026 |