Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-93450
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit....
|
7.5 High | — | 0,92% | 18 Sep 2026 |
|
CVE-2026-93309
A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulati...
|
4.3 Medium | — | 0,52% | 18 Sep 2026 |
|
CVE-2026-93308
A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipula...
|
4.3 Medium | — | 0,52% | 18 Sep 2026 |
|
CVE-2026-85887
microsoft 365 copilot
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.
|
7.7 High | — | 0,84% | 18 Sep 2026 |
|
CVE-2026-85878
microsoft azure horizondb
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
|
9.9 Critical | — | 0,78% | 18 Sep 2026 |
|
CVE-2026-83946
microsoft azure portal
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.
|
6.1 Medium | — | 0,32% | 18 Sep 2026 |
|
CVE-2026-69843
microsoft fabric
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
|
10.0 Critical | — | 0,90% | 18 Sep 2026 |
|
CVE-2026-62874
microsoft azure billing
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
|
9.8 Critical | — | 0,33% | 18 Sep 2026 |
|
CVE-2026-2585
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14...
|
6.4 Medium | — | 0,26% | 18 Sep 2026 |
|
CVE-2026-18441
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up...
|
4.3 Medium | — | 0,24% | 18 Sep 2026 |
|
CVE-2026-93436
vllm
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can subm...
|
7.5 High | — | 0,76% | 17 Sep 2026 |
|
CVE-2026-93435
redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process throug...
|
7.5 High | — | 0,68% | 17 Sep 2026 |
|
CVE-2026-87886
Advisory
acronis backup
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021,...
|
7.8 High | KEV | 0,23% | 17 Sep 2026 |
|
CVE-2026-87701
microsoft azure cosmos db
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges...
|
9.6 Critical | — | 0,79% | 17 Sep 2026 |
|
CVE-2026-85917
microsoft foundry
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
|
7.5 High | — | 0,97% | 17 Sep 2026 |
|
CVE-2026-85889
microsoft azure ai foundry
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
|
9.8 Critical | — | 0,67% | 17 Sep 2026 |
|
CVE-2026-85885
microsoft 365 copilot
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
|
8.8 High | — | 0,72% | 17 Sep 2026 |
|
CVE-2026-83944
microsoft azure logic apps
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
|
9.1 Critical | — | 0,44% | 17 Sep 2026 |
|
CVE-2026-78501
microsoft 365 copilot chat
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose i...
|
8.6 High | — | 0,54% | 17 Sep 2026 |
|
CVE-2026-77903
microsoft dataverse
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
|
8.1 High | — | 0,37% | 17 Sep 2026 |
|
CVE-2026-70200
microsoft azure logic apps
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
|
9.8 Critical | — | 0,60% | 17 Sep 2026 |
|
CVE-2026-70009
microsoft azure arc
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
|
9.8 Critical | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-69865
microsoft azure container registry
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
|
10.0 Critical | — | 0,80% | 17 Sep 2026 |
|
CVE-2026-69399
microsoft azure arc
Azure Arc Elevation of Privilege Vulnerability
|
9.8 Critical | — | 0,48% | 17 Sep 2026 |
|
CVE-2026-68791
microsoft azure machine learning
Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.
|
7.5 High | — | 0,54% | 17 Sep 2026 |
|
CVE-2026-55946
microsoft copilot
Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
|
5.9 Medium | — | 0,39% | 17 Sep 2026 |
|
CVE-2026-93426
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attack...
|
8.5 High | — | 0,50% | 17 Sep 2026 |
|
CVE-2026-93307
A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additiona...
|
4.3 Medium | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-86688
Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated ses...
|
7.4 High | — | 0,74% | 17 Sep 2026 |
|
CVE-2026-76949
Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace...
|
9.1 Critical | — | 0,77% | 17 Sep 2026 |
|
CVE-2026-73639
Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8.
With a tRN...
|
9.1 Critical | — | 0,70% | 17 Sep 2026 |
|
CVE-2026-73638
Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd.
tiff_load_ifd() validates an IFD entry's dat...
|
6.2 Medium | — | 0,19% | 17 Sep 2026 |
|
CVE-2026-54767
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose cha...
|
9.1 Critical | — | 0,78% | 17 Sep 2026 |
|
CVE-2026-54734
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without...
|
10.0 Critical | — | 0,62% | 17 Sep 2026 |
|
CVE-2026-54671
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermis...
|
8.8 High | — | 0,57% | 17 Sep 2026 |
|
CVE-2026-54670
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-c...
|
9.1 Critical | — | 0,69% | 17 Sep 2026 |
|
CVE-2026-54648
CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not requi...
|
6.5 Medium | — | 0,59% | 17 Sep 2026 |
|
CVE-2026-54647
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST p...
|
7.2 High | — | 1,4% | 17 Sep 2026 |
|
CVE-2026-54646
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHE...
|
7.2 High | — | 1,4% | 17 Sep 2026 |
|
CVE-2026-54645
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields...
|
4.8 Medium | — | 1,1% | 17 Sep 2026 |
|
CVE-2026-54644
CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, informat...
|
6.1 Medium | — | 0,90% | 17 Sep 2026 |
|
CVE-2026-54643
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delet...
|
5.4 Medium | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-54642
CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action in admin/sources/orders.index....
|
5.3 Medium | — | 0,33% | 17 Sep 2026 |
|
CVE-2026-54634
Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_s...
|
7.3 High | — | 0,44% | 17 Sep 2026 |
|
CVE-2026-54633
PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read...
|
6.9 Medium | — | 0,18% | 17 Sep 2026 |
|
CVE-2026-54613
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revi...
|
5.4 Medium | — | 0,34% | 17 Sep 2026 |
|
CVE-2026-54612
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller...
|
8.8 High | — | 0,76% | 17 Sep 2026 |
|
CVE-2026-54608
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in myt...
|
7.1 High | — | 0,20% | 17 Sep 2026 |
|
CVE-2026-54520
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation...
|
8.1 High | — | 0,49% | 17 Sep 2026 |
|
CVE-2026-54519
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controlle...
|
8.8 High | — | 0,52% | 17 Sep 2026 |