Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-59181
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3...
|
6.1 Medium | — | 0,20% | 18 Sep 2026 |
|
CVE-2026-59156
openimageio
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3...
|
6.5 Medium | — | 0,36% | 18 Sep 2026 |
|
CVE-2026-54148
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compa...
|
8.1 High | — | 0,58% | 18 Sep 2026 |
|
CVE-2026-54147
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its co...
|
6.5 Medium | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-1037
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an un...
|
6.1 Medium | — | 0,20% | 18 Sep 2026 |
|
CVE-2026-1031
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an un...
|
6.1 Medium | — | 0,20% | 18 Sep 2026 |
|
CVE-2026-1030
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about i...
|
4.3 Medium | — | 0,22% | 18 Sep 2026 |
|
CVE-2026-1029
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users...
|
5.4 Medium | — | 0,16% | 18 Sep 2026 |
|
CVE-2026-1025
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users...
|
6.1 Medium | — | 0,18% | 18 Sep 2026 |
|
CVE-2026-11537
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.
|
4.3 Medium | — | 0,19% | 18 Sep 2026 |
|
CVE-2026-11381
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list st...
|
8.8 High | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-11378
ibm mq
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing...
|
8.8 High | — | 0,34% | 18 Sep 2026 |
|
CVE-2026-11375
ibm mq
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transact...
|
8.8 High | — | 0,35% | 18 Sep 2026 |
|
CVE-2026-10858
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffe...
|
9.9 Critical | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-10853
ibm mq
IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster...
|
8.8 High | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-10841
IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling.
|
4.8 Medium | — | 0,18% | 18 Sep 2026 |
|
CVE-2026-10751
IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exce...
|
7.5 High | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-10747
IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message proces...
|
10.0 Critical | — | 0,57% | 18 Sep 2026 |
|
CVE-2026-10744
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to an integer over...
|
7.5 High | — | 0,27% | 18 Sep 2026 |
|
CVE-2026-10575
ibm mq
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operation...
|
8.8 High | — | 0,28% | 18 Sep 2026 |
|
CVE-2026-10030
IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.
|
7.1 High | — | 0,23% | 18 Sep 2026 |
|
CVE-2026-10027
ibm mq
IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels...
|
9.8 Critical | — | 0,45% | 18 Sep 2026 |
|
CVE-2025-61682
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0...
|
8.6 High | — | 0,29% | 18 Sep 2026 |
|
CVE-2025-53837
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 1...
|
9.9 Critical | — | 0,64% | 18 Sep 2026 |
|
CVE-2025-36421
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using ma...
|
5.9 Medium | — | 0,16% | 18 Sep 2026 |
|
CVE-2025-36178
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-...
|
5.4 Medium | — | 0,25% | 18 Sep 2026 |
|
CVE-2025-36147
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allows an unaut...
|
6.1 Medium | — | 0,20% | 18 Sep 2026 |
|
CVE-2025-36076
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in furthe...
|
4.3 Medium | — | 0,22% | 18 Sep 2026 |
|
CVE-2025-36045
IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
|
4.3 Medium | — | 0,26% | 18 Sep 2026 |
|
CVE-2025-33147
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecu...
|
5.9 Medium | — | 0,17% | 18 Sep 2026 |
|
CVE-2025-33141
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assig...
|
6.5 Medium | — | 0,27% | 18 Sep 2026 |
|
CVE-2025-15399
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attac...
|
10.0 Critical | — | 0,18% | 18 Sep 2026 |
|
CVE-2025-14754
ibm cloud pak for data
IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user sup...
|
8.8 High | — | 0,44% | 18 Sep 2026 |
|
CVE-2025-14753
ibm cloud pak for data
IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot d...
|
7.5 High | — | 0,46% | 18 Sep 2026 |
|
CVE-2026-93685
A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlyin...
|
5.4 Medium | — | 0,44% | 18 Sep 2026 |
|
CVE-2026-93676
xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to...
|
3.2 Low | — | 0,14% | 18 Sep 2026 |
|
CVE-2026-93660
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users'...
|
6.5 Medium | — | 0,43% | 18 Sep 2026 |
|
CVE-2026-93659
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store sc...
|
8.1 High | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-93658
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid...
|
7.0 High | — | 0,14% | 18 Sep 2026 |
|
CVE-2026-93657
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid record...
|
7.5 High | — | 0,40% | 18 Sep 2026 |
|
CVE-2026-93653
A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilin...
|
5.5 Medium | — | 0,15% | 18 Sep 2026 |
|
CVE-2026-93652
Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause DoS
|
7.5 High | — | 0,55% | 18 Sep 2026 |
|
CVE-2026-93576
A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A...
|
7.5 High | — | 0,27% | 18 Sep 2026 |
|
CVE-2026-93573
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encod...
|
6.5 Medium | — | 0,90% | 18 Sep 2026 |
|
CVE-2026-93569
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes b...
|
8.2 High | — | 2,2% | 18 Sep 2026 |
|
CVE-2026-93568
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object...
|
7.5 High | — | 0,96% | 18 Sep 2026 |
|
CVE-2026-93567
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authori...
|
7.5 High | — | 2,6% | 18 Sep 2026 |
|
CVE-2026-93566
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. T...
|
6.5 Medium | — | 0,48% | 18 Sep 2026 |
|
CVE-2026-93565
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (...
|
7.5 High | — | 0,77% | 18 Sep 2026 |
|
CVE-2026-93564
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protoc...
|
7.5 High | — | 0,94% | 18 Sep 2026 |