Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-90142
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix resize of the RX ring
When a AF_XDP socket is attached, the virtnet_rx_resize
should...
|
7.8 High | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-90141
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix integer overflow in ftp helper port/address parsing
ip_vs_ftp_get_addrport() accumulates d...
|
7.3 High | — | 0,45% | 17 Sep 2026 |
|
CVE-2026-90137
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: hp-bioscfg: fix password encoding bounds check
The password PSWD_ENCODINGS parser read...
|
7.7 High | — | 0,18% | 17 Sep 2026 |
|
CVE-2026-90133
In the Linux kernel, the following vulnerability has been resolved:
ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()
ntfs_ir_to_ib copies all entries from index_r...
|
7.8 High | — | 0,21% | 17 Sep 2026 |
|
CVE-2026-90132
In the Linux kernel, the following vulnerability has been resolved:
ntfs: reject unprivileged writes to reserved $LX* xattrs
Reject setxattr of the reserved $LXUID, $LX...
|
7.1 High | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-90131
In the Linux kernel, the following vulnerability has been resolved:
ntfs: serialize resident iomap reads with mrec_lock
ntfs_read_iomap_begin_resident() walks the MFT r...
|
7.1 High | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-90120
In the Linux kernel, the following vulnerability has been resolved:
irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing
In gic_acpi_parse_iaff...
|
8.4 High | — | 0,20% | 17 Sep 2026 |
|
CVE-2026-90118
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix off-by-one page overflow in ntfs_decompress()
The per-token range check in ntfs_decompress...
|
7.8 High | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-90111
In the Linux kernel, the following vulnerability has been resolved:
ip6mr: do not clone dst in ip6mr_cache_report()
IPv6 input attaches a non-refcounted (NOREF) dst to...
|
7.8 High | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-90110
In the Linux kernel, the following vulnerability has been resolved:
inetpeer: randomize RB-tree node comparison using SipHash
The inetpeer rate limiting system stores p...
|
9.4 Critical | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-90104
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.1: zero referring call lists before decoding
decode_cb_sequence_args() allocates csa_rclists w...
|
9.8 Critical | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-90103
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
encode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LA...
|
7.5 High | — | 0,70% | 17 Sep 2026 |
|
CVE-2026-90102
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/pnfs: key the data server cache on the NFS version
nfs4_pnfs_ds_add() keys the per-net data se...
|
7.5 High | — | 0,70% | 17 Sep 2026 |
|
CVE-2026-90093
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
Since commit b66774b48dd9 ("Bluetooth:...
|
7.8 High | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-90092
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
New sk should not be added to parent sock...
|
8.0 High | — | 0,35% | 17 Sep 2026 |
|
CVE-2026-90091
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
For L2CAP sockets without owning...
|
8.0 High | — | 0,35% | 17 Sep 2026 |
|
CVE-2026-90089
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btnxpuart: Validate the FW dump header length
nxp_process_fw_dump() pulls the ACL header...
|
7.1 High | — | 0,33% | 17 Sep 2026 |
|
CVE-2026-90071
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_teql: restore skb->dev on the slave failure path
teql_master_xmit() sets skb->dev = s...
|
7.8 High | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-90069
In the Linux kernel, the following vulnerability has been resolved:
crypto: acomp - allocate async request context when cloning
ACOMP_REQUEST_ON_STACK() reserves only e...
|
7.8 High | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-90067
In the Linux kernel, the following vulnerability has been resolved:
libceph: validate banner payload length
When parsing the Ceph messenger v2 protocol banner, the `pay...
|
7.5 High | — | 0,67% | 17 Sep 2026 |
|
CVE-2026-90062
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: move hardware offload step after building the chain blob
Allocate the chain bl...
|
7.1 High | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-90059
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
Since the RX path was converted to zero-copy,...
|
7.5 High | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-90057
In the Linux kernel, the following vulnerability has been resolved:
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
Jaeyoung Chung and Eulgyu Kim...
|
7.8 High | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-90051
In the Linux kernel, the following vulnerability has been resolved:
tcp: reject non zerocopy devmem tx
Devmem tcp tx doesn't work without zero-copy, however it's not cu...
|
7.8 High | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-8674
Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or...
|
5.3 Medium | — | 0,32% | 17 Sep 2026 |
|
CVE-2026-85720
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12,...
|
5.9 Medium | — | 0,27% | 17 Sep 2026 |
|
CVE-2026-85716
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScra...
|
3.7 Low | — | 0,41% | 17 Sep 2026 |
|
CVE-2026-54587
mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_read_install_pkg.c used path-ba...
|
5.8 Medium | — | 0,11% | 17 Sep 2026 |
|
CVE-2026-54586
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accep...
|
6.0 Medium | — | 0,15% | 17 Sep 2026 |
|
CVE-2026-54585
mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination pat...
|
6.0 Medium | — | 0,54% | 17 Sep 2026 |
|
CVE-2026-54583
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before co...
|
8.3 High | — | 0,54% | 17 Sep 2026 |
|
CVE-2026-54582
mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. Th...
|
6.0 Medium | — | 0,55% | 17 Sep 2026 |
|
CVE-2026-54581
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash ve...
|
8.3 High | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-54580
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mport_decompress_zstd(), a...
|
8.3 High | — | 0,26% | 17 Sep 2026 |
|
CVE-2026-54579
mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply usin...
|
2.3 Low | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-54578
mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare a...
|
2.0 Low | — | 0,11% | 17 Sep 2026 |
|
CVE-2026-54577
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the orig...
|
2.0 Low | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-54576
mport is the MidnightBSD Package Manager. Prior to 2.7.8, do_actual_install() in libmport/bundle_read_install_pkg.c used path-based lstat(), chown(), stat(), and chmod()...
|
5.8 Medium | — | 0,11% | 17 Sep 2026 |
|
CVE-2026-54575
mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, li...
|
5.8 Medium | — | 0,12% | 17 Sep 2026 |
|
CVE-2026-28326
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.
|
8.8 High | — | 0,69% | 17 Sep 2026 |
|
CVE-2026-93015
BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVD...
|
6.3 Medium | — | 0,39% | 17 Sep 2026 |
|
CVE-2026-93014
RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files v...
|
7.1 High | — | 0,50% | 17 Sep 2026 |
|
CVE-2026-93013
RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated at...
|
4.3 Medium | — | 0,51% | 17 Sep 2026 |
|
CVE-2026-92881
A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta/awb.c of the component AWB pa...
|
4.3 Medium | — | 0,59% | 17 Sep 2026 |
|
CVE-2026-91039
Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc stra...
|
9.1 Critical | — | 0,66% | 17 Sep 2026 |
|
CVE-2026-89036
Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary co...
|
8.8 High | — | 0,70% | 17 Sep 2026 |
|
CVE-2026-86864
pgadmin 4
pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing position...
|
8.8 High | — | 0,58% | 17 Sep 2026 |
|
CVE-2026-86863
pgadmin 4
pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/...
|
9.8 Critical | — | 0,58% | 17 Sep 2026 |
|
CVE-2026-86862
pgadmin 4
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq exp...
|
6.5 Medium | — | 0,35% | 17 Sep 2026 |
|
CVE-2026-86861
pgadmin 4
pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and t...
|
5.9 Medium | — | 0,32% | 17 Sep 2026 |