Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-90822
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An u...
|
9.8 Critical | — | 1,4% | 17 Sep 2026 |
|
CVE-2026-81480
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access coul...
|
7.2 High | — | 0,62% | 17 Sep 2026 |
|
CVE-2026-81479
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could po...
|
5.5 Medium | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-81478
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote ac...
|
9.8 Critical | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-81477
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could...
|
7.2 High | — | 0,62% | 17 Sep 2026 |
|
CVE-2026-81476
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') v...
|
9.8 Critical | — | 0,95% | 17 Sep 2026 |
|
CVE-2026-81475
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with...
|
9.8 Critical | — | 0,53% | 17 Sep 2026 |
|
CVE-2026-81441
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with...
|
5.5 Medium | — | 0,11% | 17 Sep 2026 |
|
CVE-2026-81440
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access c...
|
9.8 Critical | — | 0,21% | 17 Sep 2026 |
|
CVE-2026-78296
Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing.
This issue affects FluentAuth: from n/a through 2...
|
5.3 Medium | — | 0,16% | 17 Sep 2026 |
|
CVE-2026-92903
Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as mu...
|
8.2 High | — | 0,19% | 17 Sep 2026 |
|
CVE-2026-92893
A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the s...
|
4.3 Medium | — | 0,28% | 17 Sep 2026 |
|
CVE-2026-92611
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule inste...
|
4.8 Medium | — | 0,30% | 17 Sep 2026 |
|
CVE-2026-81474
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A low privileged attacker with local access could p...
|
7.8 High | — | 0,15% | 17 Sep 2026 |
|
CVE-2026-81439
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could po...
|
6.5 Medium | — | 0,17% | 17 Sep 2026 |
|
CVE-2026-81438
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker wit...
|
7.5 High | — | 0,15% | 17 Sep 2026 |
|
CVE-2026-66269
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerabil...
|
7.5 High | — | 0,20% | 17 Sep 2026 |
|
CVE-2026-92894
A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs...
|
4.3 Medium | — | 0,26% | 17 Sep 2026 |
|
CVE-2026-78428
For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO...
|
8.8 High | — | 0,27% | 17 Sep 2026 |
|
CVE-2026-78427
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Sinc...
|
5.3 Medium | — | 0,24% | 17 Sep 2026 |
|
CVE-2026-78426
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged...
|
2.0 Low | — | 0,19% | 17 Sep 2026 |
|
CVE-2026-78425
Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they le...
|
7.6 High | — | 0,36% | 17 Sep 2026 |
|
CVE-2026-50610
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged...
|
7.4 High | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-50609
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged N...
|
7.4 High | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-50608
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly...
|
1.2 Low | — | 0,21% | 17 Sep 2026 |
|
CVE-2026-15688
Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully aut...
|
9.2 Critical | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-87831
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it,...
|
4.3 Medium | — | 0,25% | 17 Sep 2026 |
|
CVE-2026-87829
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it,...
|
4.3 Medium | — | 0,25% | 17 Sep 2026 |
|
CVE-2026-86320
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source con...
|
7.8 High | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-50607
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on al...
|
2.7 Low | — | 0,43% | 17 Sep 2026 |
|
CVE-2026-50606
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-c...
|
1.2 Low | — | 0,10% | 17 Sep 2026 |
|
CVE-2026-50605
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged servi...
|
7.4 High | — | 0,13% | 17 Sep 2026 |
|
CVE-2026-91017
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferr...
|
3.7 Low | — | 0,14% | 17 Sep 2026 |
|
CVE-2026-90982
@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows...
|
5.3 Medium | — | 0,59% | 17 Sep 2026 |
|
CVE-2026-87963
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPr...
|
8.6 High | — | 0,45% | 17 Sep 2026 |
|
CVE-2026-86801
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability...
|
8.8 High | — | 0,51% | 17 Sep 2026 |
|
CVE-2026-44940
The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. A...
|
5.7 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-91019
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Cont...
|
4.9 Medium | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-91016
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthent...
|
5.3 Medium | — | 0,32% | 17 Sep 2026 |
|
CVE-2026-91015
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relyi...
|
5.3 Medium | — | 0,30% | 17 Sep 2026 |
|
CVE-2026-91014
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the pag...
|
7.1 High | — | 0,28% | 17 Sep 2026 |
|
CVE-2026-91011
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with aut...
|
6.8 Medium | — | 0,43% | 17 Sep 2026 |
|
CVE-2026-91010
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX...
|
4.3 Medium | — | 0,25% | 17 Sep 2026 |
|
CVE-2026-91009
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowin...
|
4.3 Medium | — | 0,14% | 17 Sep 2026 |
|
CVE-2026-91008
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation detail...
|
3.7 Low | — | 0,26% | 17 Sep 2026 |
|
CVE-2026-90923
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored...
|
6.5 Medium | — | 0,27% | 17 Sep 2026 |
|
CVE-2026-90922
The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment b...
|
5.3 Medium | — | 0,30% | 17 Sep 2026 |
|
CVE-2026-88904
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the reques...
|
8.8 High | — | 0,42% | 17 Sep 2026 |
|
CVE-2026-88795
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and c...
|
9.0 Critical | — | 0,81% | 17 Sep 2026 |
|
CVE-2026-88792
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenti...
|
8.8 High | — | 0,51% | 17 Sep 2026 |