Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-61794
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidd...
|
6.8 Medium | — | 0,59% | 18 Sep 2026 |
|
CVE-2026-61672
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata key...
|
7.1 High | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-61633
NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a faile...
|
2.0 Low | — | 0,34% | 18 Sep 2026 |
|
CVE-2026-61548
Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucd...
|
8.1 High | — | 0,94% | 18 Sep 2026 |
|
CVE-2026-58197
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, local...
|
8.8 High | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-55556
Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c alloc...
|
8.2 High | — | 0,85% | 18 Sep 2026 |
|
CVE-2026-46655
virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_...
|
7.8 High | — | 0,18% | 18 Sep 2026 |
|
CVE-2026-44639
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked l...
|
3.7 Low | — | 0,44% | 18 Sep 2026 |
|
CVE-2026-93737
Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configurati...
|
6.5 Medium | — | 0,54% | 18 Sep 2026 |
|
CVE-2026-93736
Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favor...
|
4.3 Medium | — | 0,39% | 18 Sep 2026 |
|
CVE-2026-93690
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or pa...
|
7.5 High | — | 0,68% | 18 Sep 2026 |
|
CVE-2026-93689
WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume contex...
|
5.5 Medium | — | 0,15% | 18 Sep 2026 |
|
CVE-2026-93688
SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state a...
|
7.5 High | — | 0,72% | 18 Sep 2026 |
|
CVE-2026-93687
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under...
|
7.5 High | — | 0,76% | 18 Sep 2026 |
|
CVE-2026-93532
A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/m...
|
6.3 Medium | — | 0,51% | 18 Sep 2026 |
|
CVE-2026-93531
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This manipulatio...
|
4.3 Medium | — | 0,23% | 18 Sep 2026 |
|
CVE-2026-88259
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected...
|
7.5 High | — | 0,52% | 18 Sep 2026 |
|
CVE-2026-86689
Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were conne...
|
5.9 Medium | — | 0,23% | 18 Sep 2026 |
|
CVE-2026-86520
Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were conne...
|
7.5 High | — | 0,41% | 18 Sep 2026 |
|
CVE-2026-84451
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed(...
|
6.5 Medium | — | 0,31% | 18 Sep 2026 |
|
CVE-2026-84450
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater...
|
4.3 Medium | — | 0,28% | 18 Sep 2026 |
|
CVE-2026-84449
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width tha...
|
3.7 Low | — | 0,43% | 18 Sep 2026 |
|
CVE-2026-84448
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/hei...
|
4.0 Medium | — | 0,19% | 18 Sep 2026 |
|
CVE-2026-84447
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image...
|
7.5 High | — | 0,52% | 18 Sep 2026 |
|
CVE-2026-84446
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() co...
|
7.5 High | — | 0,46% | 18 Sep 2026 |
|
CVE-2026-84444
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independent...
|
7.4 High | — | 0,48% | 18 Sep 2026 |
|
CVE-2026-84400
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local ne...
|
3.1 Low | — | 0,21% | 18 Sep 2026 |
|
CVE-2026-84398
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device c...
|
7.5 High | — | 0,41% | 18 Sep 2026 |
|
CVE-2026-84384
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli()...
|
7.5 High | — | 0,52% | 18 Sep 2026 |
|
CVE-2026-84383
libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can m...
|
9.8 Critical | — | 0,61% | 18 Sep 2026 |
|
CVE-2026-81946
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algori...
|
4.4 Medium | — | 0,17% | 18 Sep 2026 |
|
CVE-2026-81945
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web serve...
|
6.6 Medium | — | 0,58% | 18 Sep 2026 |
|
CVE-2026-81944
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web serve...
|
7.5 High | — | 0,71% | 18 Sep 2026 |
|
CVE-2026-81943
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded sof...
|
6.7 Medium | — | 0,18% | 18 Sep 2026 |
|
CVE-2026-81942
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the w...
|
8.8 High | — | 1,9% | 18 Sep 2026 |
|
CVE-2026-81305
CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical access to t...
|
6.8 Medium | — | 0,28% | 18 Sep 2026 |
|
CVE-2026-77960
Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were conne...
|
5.3 Medium | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-75883
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpack...
|
6.8 Medium | — | 0,18% | 18 Sep 2026 |
|
CVE-2026-75031
In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the
“quick question” admin feature. In default installations ar...
|
9.8 Critical | — | 0,71% | 18 Sep 2026 |
|
CVE-2026-7006
Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged...
|
7.3 High | — | 0,13% | 18 Sep 2026 |
|
CVE-2026-67549
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit conti...
|
7.6 High | — | 0,29% | 18 Sep 2026 |
|
CVE-2026-65970
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compres...
|
5.3 Medium | — | 0,42% | 18 Sep 2026 |
|
CVE-2026-65969
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3...
|
5.5 Medium | — | 0,20% | 18 Sep 2026 |
|
CVE-2026-63638
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3...
|
8.3 High | — | 0,46% | 18 Sep 2026 |
|
CVE-2026-63635
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3...
|
5.5 Medium | — | 0,19% | 18 Sep 2026 |
|
CVE-2026-63422
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3...
|
7.8 High | — | 0,21% | 18 Sep 2026 |
|
CVE-2026-63420
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3...
|
5.5 Medium | — | 0,20% | 18 Sep 2026 |
|
CVE-2026-63419
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3...
|
7.8 High | — | 0,22% | 18 Sep 2026 |
|
CVE-2026-61682
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not...
|
9.9 Critical | — | 0,38% | 18 Sep 2026 |
|
CVE-2026-59956
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3...
|
6.1 Medium | — | 0,20% | 18 Sep 2026 |