Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-86040
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through Pee...
|
7.5 High | — | 0,67% | 17 Sep 2026 |
|
CVE-2026-86039
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRec...
|
8.2 High | — | 0,27% | 17 Sep 2026 |
|
CVE-2026-86038
libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub...
|
7.5 High | — | 0,19% | 17 Sep 2026 |
|
CVE-2026-86000
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with a...
|
5.3 Medium | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-85999
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_...
|
5.3 Medium | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-85721
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12,...
|
7.5 High | — | 0,63% | 17 Sep 2026 |
|
CVE-2026-85719
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12,...
|
7.5 High | — | 0,36% | 17 Sep 2026 |
|
CVE-2026-85718
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client wi...
|
5.9 Medium | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-85717
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9...
|
6.8 Medium | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-85715
ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src/image-head...
|
7.5 High | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-81868
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorizati...
|
6.5 Medium | — | 0,25% | 17 Sep 2026 |
|
CVE-2026-81516
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient...
|
7.5 High | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-81515
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, EurekaDiscoveryClient...
|
7.5 High | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-76834
b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails t...
|
8.1 High | — | 0,85% | 17 Sep 2026 |
|
CVE-2026-76781
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This...
|
5.5 Medium | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-75588
mattermost desktop
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a netwo...
|
2.6 Low | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-75523
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpo...
|
5.9 Medium | — | 0,44% | 17 Sep 2026 |
|
CVE-2026-69197
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not t...
|
8.7 High | — | 0,66% | 17 Sep 2026 |
|
CVE-2026-61700
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket p...
|
3.7 Low | — | 0,37% | 17 Sep 2026 |
|
CVE-2026-56795
Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could pote...
|
8.2 High | — | 0,19% | 17 Sep 2026 |
|
CVE-2026-12284
mattermost desktop
Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a us...
|
3.7 Low | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-92987
roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML document...
|
7.5 High | — | 0,63% | 17 Sep 2026 |
|
CVE-2026-92986
SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename AP...
|
8.8 High | — | 0,82% | 17 Sep 2026 |
|
CVE-2026-92985
SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook...
|
8.8 High | — | 0,82% | 17 Sep 2026 |
|
CVE-2026-92984
HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate vic...
|
8.1 High | — | 0,46% | 17 Sep 2026 |
|
CVE-2026-92983
InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instea...
|
7.5 High | — | 0,66% | 17 Sep 2026 |
|
CVE-2026-92880
A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl pa...
|
6.3 Medium | — | 0,43% | 17 Sep 2026 |
|
CVE-2026-88952
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account tha...
|
9.1 Critical | — | 0,75% | 17 Sep 2026 |
|
CVE-2026-87742
A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection...
|
7.5 High | — | 0,76% | 17 Sep 2026 |
|
CVE-2026-85078
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the term...
|
6.5 Medium | — | 0,51% | 17 Sep 2026 |
|
CVE-2026-85077
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes...
|
8.2 High | — | 0,49% | 17 Sep 2026 |
|
CVE-2026-81447
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent net...
|
6.8 Medium | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-81446
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote acc...
|
7.4 High | — | 0,37% | 17 Sep 2026 |
|
CVE-2026-81445
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access c...
|
7.2 High | — | 0,46% | 17 Sep 2026 |
|
CVE-2026-80356
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low privileged a...
|
7.3 High | — | 0,14% | 17 Sep 2026 |
|
CVE-2026-79752
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::d...
|
9.2 Critical | — | 0,62% | 17 Sep 2026 |
|
CVE-2026-77614
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configura...
|
8.8 High | — | 0,55% | 17 Sep 2026 |
|
CVE-2026-71538
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when...
|
8.5 High | — | 0,21% | 17 Sep 2026 |
|
CVE-2026-63472
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-au...
|
9.1 Critical | — | 0,59% | 17 Sep 2026 |
|
CVE-2026-63461
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards wi...
|
5.3 Medium | — | 0,44% | 17 Sep 2026 |
|
CVE-2026-63460
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracki...
|
7.5 High | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-63459
Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-...
|
8.7 High | — | 0,42% | 17 Sep 2026 |
|
CVE-2026-61793
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaul...
|
6.9 Medium | — | 0,50% | 17 Sep 2026 |
|
CVE-2026-54471
dell smartfabric manager
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with r...
|
6.5 Medium | — | 0,19% | 17 Sep 2026 |
|
CVE-2026-26950
dell smartfabric manager
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access...
|
8.8 High | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-92973
ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers...
|
6.1 Medium | — | 0,39% | 17 Sep 2026 |
|
CVE-2026-92972
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to pois...
|
8.6 High | — | 0,47% | 17 Sep 2026 |
|
CVE-2026-92971
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate th...
|
7.5 High | — | 0,70% | 17 Sep 2026 |
|
CVE-2026-92970
HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outs...
|
8.8 High | — | 0,82% | 17 Sep 2026 |
|
CVE-2026-92963
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal...
|
5.3 Medium | — | 0,34% | 17 Sep 2026 |