Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-54355
MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=applicatio...
|
5.3 Medium | — | 0,50% | 17 Sep 2026 |
|
CVE-2026-54354
MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTr...
|
8.2 High | — | 0,68% | 17 Sep 2026 |
|
CVE-2026-54339
Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feed_url to discover_feed(f...
|
7.7 High | — | 0,47% | 17 Sep 2026 |
|
CVE-2026-54237
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after ins...
|
9.3 Critical | — | 0,76% | 17 Sep 2026 |
|
CVE-2026-52483
The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow authenticated users execute arbitr...
|
8.8 High | — | 0,52% | 17 Sep 2026 |
|
CVE-2026-50277
dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_I...
|
7.5 High | — | 0,79% | 17 Sep 2026 |
|
CVE-2026-50275
The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracin...
|
7.5 High | — | 0,68% | 17 Sep 2026 |
|
CVE-2026-50022
Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-controlled qt pa...
|
5.8 Medium | — | 0,40% | 17 Sep 2026 |
|
CVE-2026-48977
OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts...
|
7.7 High | — | 0,48% | 17 Sep 2026 |
|
CVE-2026-45143
Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization a...
|
9.0 Critical | — | 0,49% | 17 Sep 2026 |
|
CVE-2026-45140
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. T...
|
9.8 Critical | — | 1,3% | 17 Sep 2026 |
|
CVE-2026-15815
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
extracting plugin archives. A crafted plugin archive can chain relative symbolic link
entrie...
|
8.8 High | — | 0,69% | 17 Sep 2026 |
|
CVE-2025-55787
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists.
|
9.8 Critical | — | 0,32% | 17 Sep 2026 |
|
CVE-2021-3030
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx. A remote, u...
|
6.1 Medium | — | 0,27% | 17 Sep 2026 |
|
CVE-2026-93337
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions...
|
7.8 High | — | 0,15% | 17 Sep 2026 |
|
CVE-2026-92993
A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machine_scri...
|
6.3 Medium | — | 1,5% | 17 Sep 2026 |
|
CVE-2026-92943
Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later...
|
8.1 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-92758
mongodb entity framework core provider
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS...
|
5.5 Medium | — | 0,15% | 17 Sep 2026 |
|
CVE-2026-92757
mongodb entity framework core provider
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.
|
5.5 Medium | — | 0,07% | 17 Sep 2026 |
|
CVE-2026-92756
mongodb entity framework core provider
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS a...
|
5.5 Medium | — | 0,07% | 17 Sep 2026 |
|
CVE-2026-54752
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-c...
|
9.6 Critical | — | 0,66% | 17 Sep 2026 |
|
CVE-2026-54716
Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containi...
|
7.5 High | — | 0,46% | 17 Sep 2026 |
|
CVE-2026-54692
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in s...
|
7.8 High | — | 0,19% | 17 Sep 2026 |
|
CVE-2026-54627
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psd_private_sail_pixel_forma...
|
9.8 Critical | — | 0,78% | 17 Sep 2026 |
|
CVE-2026-54626
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_RLE path sel...
|
9.8 Critical | — | 0,78% | 17 Sep 2026 |
|
CVE-2026-54618
Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session che...
|
9.4 Critical | — | 0,51% | 17 Sep 2026 |
|
CVE-2026-54594
OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the i...
|
5.3 Medium | — | 0,45% | 17 Sep 2026 |
|
CVE-2026-54495
The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use t...
|
4.3 Medium | — | 0,31% | 17 Sep 2026 |
|
CVE-2026-50285
Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data wi...
|
7.5 High | — | 0,74% | 17 Sep 2026 |
|
CVE-2026-50125
MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenti...
|
7.5 High | — | 0,49% | 17 Sep 2026 |
|
CVE-2026-45726
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterS...
|
7.6 High | — | 0,14% | 17 Sep 2026 |
|
CVE-2026-45723
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go...
|
2.7 Low | — | 0,49% | 17 Sep 2026 |
|
CVE-2026-45720
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.g...
|
7.0 High | — | 0,14% | 17 Sep 2026 |
|
CVE-2026-92992
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the...
|
6.3 Medium | — | 0,39% | 17 Sep 2026 |
|
CVE-2026-92230
Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSG...
|
7.5 High | — | 0,49% | 17 Sep 2026 |
|
CVE-2026-90997
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's applicat...
|
7.4 High | — | 0,40% | 17 Sep 2026 |
|
CVE-2026-55062
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filenam...
|
8.4 High | — | 0,19% | 17 Sep 2026 |
|
CVE-2026-55061
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with stri...
|
1.0 Low | — | 0,15% | 17 Sep 2026 |
|
CVE-2026-54649
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias...
|
2.1 Low | — | 0,84% | 17 Sep 2026 |
|
CVE-2026-54617
GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a...
|
9.8 Critical | — | 2,9% | 17 Sep 2026 |
|
CVE-2026-54571
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRe...
|
8.7 High | — | 0,52% | 17 Sep 2026 |
|
CVE-2026-54524
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the...
|
7.1 High | — | 0,48% | 17 Sep 2026 |
|
CVE-2026-54504
MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI...
|
8.8 High | — | 0,57% | 17 Sep 2026 |
|
CVE-2026-54451
Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder...
|
8.2 High | — | 0,52% | 17 Sep 2026 |
|
CVE-2026-54253
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-con...
|
8.2 High | — | 0,28% | 17 Sep 2026 |
|
CVE-2026-54239
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte i...
|
8.8 High | — | 0,32% | 17 Sep 2026 |
|
CVE-2026-52852
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-paren...
|
6.5 Medium | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-52851
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE...
|
7.1 High | — | 0,39% | 17 Sep 2026 |
|
CVE-2026-52727
lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml reta...
|
7.2 High | — | 0,59% | 17 Sep 2026 |
|
CVE-2026-47252
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute oper...
|
9.0 Critical | — | 0,71% | 17 Sep 2026 |