Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-28197
An authenticated, low-privileged user with access to the NetBackup Flex
OS management shell could supply a specially crafted input to a
privileged administrative comman...
|
8.8 High | — | 0,67% | 18 Sep 2026 |
|
CVE-2026-21806
hcltech bigfix service management
HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for...
|
9.8 Critical | — | 0,20% | 18 Sep 2026 |
|
CVE-2026-93578
A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responde...
|
5.9 Medium | — | 0,23% | 18 Sep 2026 |
|
CVE-2026-93575
A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder...
|
7.5 High | — | 0,39% | 18 Sep 2026 |
|
CVE-2026-93572
A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array head...
|
7.5 High | — | 0,34% | 18 Sep 2026 |
|
CVE-2026-93563
A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sendi...
|
7.5 High | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-93561
A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of uns...
|
6.5 Medium | — | 0,29% | 18 Sep 2026 |
|
CVE-2026-81627
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged gu...
|
8.2 High | — | 0,19% | 18 Sep 2026 |
|
CVE-2026-92976
A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML o...
|
5.1 Medium | — | 0,38% | 18 Sep 2026 |
|
CVE-2026-90884
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insuff...
|
5.4 Medium | — | 0,24% | 18 Sep 2026 |
|
CVE-2026-87915
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via v...
|
7.2 High | — | 0,49% | 18 Sep 2026 |
|
CVE-2026-87743
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request...
|
7.5 High | — | 0,52% | 18 Sep 2026 |
|
CVE-2026-18405
The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment...
|
7.2 High | — | 0,29% | 18 Sep 2026 |
|
CVE-2026-15797
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via p...
|
6.4 Medium | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-15579
An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This...
|
8.8 High | — | 0,44% | 18 Sep 2026 |
|
CVE-2026-85410
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to author...
|
8.1 High | — | 0,59% | 18 Sep 2026 |
|
CVE-2026-83561
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in...
|
7.2 High | — | 0,51% | 18 Sep 2026 |
|
CVE-2026-6205
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-900...
|
8.1 High | — | 0,52% | 18 Sep 2026 |
|
CVE-2026-56597
hcltech bigfix service management
HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses...
|
5.3 Medium | — | 0,17% | 18 Sep 2026 |
|
CVE-2026-56595
hcltech bigfix service management
HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a ma...
|
4.3 Medium | — | 0,15% | 18 Sep 2026 |
|
CVE-2026-56592
hcltech bigfix service management
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthentica...
|
9.8 Critical | — | 0,29% | 18 Sep 2026 |
|
CVE-2026-56590
hcltech bigfix service management
HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated atta...
|
9.8 Critical | — | 0,19% | 18 Sep 2026 |
|
CVE-2026-40539
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-t...
|
7.1 High | — | 0,12% | 18 Sep 2026 |
|
CVE-2026-40538
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7....
|
3.7 Low | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-40537
A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows r...
|
4.3 Medium | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-40536
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,...
|
4.3 Medium | — | 0,42% | 18 Sep 2026 |
|
CVE-2026-4036
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69...
|
6.5 Medium | — | 0,45% | 18 Sep 2026 |
|
CVE-2026-40535
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10...
|
6.5 Medium | — | 0,50% | 18 Sep 2026 |
|
CVE-2026-40534
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-6905...
|
5.4 Medium | — | 0,27% | 18 Sep 2026 |
|
CVE-2026-40533
An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3....
|
5.3 Medium | — | 0,38% | 18 Sep 2026 |
|
CVE-2026-40532
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows r...
|
6.5 Medium | — | 0,42% | 18 Sep 2026 |
|
CVE-2026-40531
An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remo...
|
4.3 Medium | — | 0,44% | 18 Sep 2026 |
|
CVE-2026-40530
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7...
|
8.0 High | — | 0,49% | 18 Sep 2026 |
|
CVE-2026-21848
hcltech bigfix service management
HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, e...
|
5.0 Medium | — | 0,16% | 18 Sep 2026 |
|
CVE-2026-21822
HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker...
|
6.3 Medium | — | 0,21% | 18 Sep 2026 |
|
CVE-2026-13684
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 a...
|
9.8 Critical | — | 0,60% | 18 Sep 2026 |
|
CVE-2026-13683
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7...
|
2.7 Low | — | 0,32% | 18 Sep 2026 |
|
CVE-2026-13673
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009...
|
8.8 High | — | 0,39% | 18 Sep 2026 |
|
CVE-2026-13666
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7...
|
3.5 Low | — | 0,25% | 18 Sep 2026 |
|
CVE-2026-13639
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote...
|
9.8 Critical | — | 0,66% | 18 Sep 2026 |
|
CVE-2026-13635
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-900...
|
5.3 Medium | — | 0,34% | 18 Sep 2026 |
|
CVE-2026-13623
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-6905...
|
4.8 Medium | — | 0,25% | 18 Sep 2026 |
|
CVE-2025-13533
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fiel...
|
4.4 Medium | — | 0,19% | 18 Sep 2026 |
|
CVE-2026-93494
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its t...
|
7.5 High | — | 0,41% | 18 Sep 2026 |
|
CVE-2026-93493
A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP)...
|
5.9 Medium | — | 0,22% | 18 Sep 2026 |
|
CVE-2026-92622
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3...
|
6.4 Medium | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-92554
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter...
|
6.1 Medium | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-92249
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to i...
|
6.1 Medium | — | 0,37% | 18 Sep 2026 |
|
CVE-2026-90981
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and...
|
6.1 Medium | — | 0,38% | 18 Sep 2026 |
|
CVE-2026-89059
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixe...
|
7.5 High | — | 0,85% | 18 Sep 2026 |