Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-86003
CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dns...
|
7.5 High | — | 0,44% | 16 Sep 2026 |
|
CVE-2026-82399
CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core...
|
7.5 High | — | 0,61% | 16 Sep 2026 |
|
CVE-2026-81876
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/ja...
|
7.5 High | — | 0,63% | 16 Sep 2026 |
|
CVE-2026-81875
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/ja...
|
7.5 High | — | 0,63% | 16 Sep 2026 |
|
CVE-2026-81176
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject...
|
5.3 Medium | — | 0,51% | 16 Sep 2026 |
|
CVE-2026-79298
An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrary code via the BOOTia32.efi an...
|
8.4 High | — | 0,19% | 16 Sep 2026 |
|
CVE-2026-77360
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/...
|
6.3 Medium | — | 0,54% | 16 Sep 2026 |
|
CVE-2026-75516
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Mat...
|
8.7 High | — | 0,55% | 16 Sep 2026 |
|
CVE-2026-75025
mattermost desktop
Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or privat...
|
4.7 Medium | — | 0,16% | 16 Sep 2026 |
|
CVE-2026-73462
On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthen...
|
6.5 Medium | — | 0,28% | 16 Sep 2026 |
|
CVE-2026-73457
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be lo...
|
5.3 Medium | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-73456
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craf...
|
10.0 Critical | — | 0,70% | 16 Sep 2026 |
|
CVE-2026-73443
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is...
|
4.7 Medium | — | 0,27% | 16 Sep 2026 |
|
CVE-2026-73442
On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticat...
|
3.0 Low | — | 0,21% | 16 Sep 2026 |
|
CVE-2026-68536
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core.
Older unsupported versions may also be affected.
Users are recommended to upgrade to versions...
|
9.8 Critical | — | 0,49% | 16 Sep 2026 |
|
CVE-2026-63325
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command...
|
7.8 High | — | 0,22% | 16 Sep 2026 |
|
CVE-2026-63225
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir...
|
4.4 Medium | — | 0,18% | 16 Sep 2026 |
|
CVE-2026-63126
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacke...
|
7.5 High | — | 0,82% | 16 Sep 2026 |
|
CVE-2026-59823
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can...
|
5.3 Medium | — | 0,44% | 16 Sep 2026 |
|
CVE-2026-46352
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5...
|
7.5 High | — | 0,47% | 16 Sep 2026 |
|
CVE-2026-38999
A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers to cause a Denial of Service...
|
7.5 High | — | 1,4% | 16 Sep 2026 |
|
CVE-2026-92720
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs....
|
9.1 Critical | — | 0,63% | 16 Sep 2026 |
|
CVE-2026-92719
Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing attackers to make the node issue requests to arbitra...
|
7.5 High | — | 0,48% | 16 Sep 2026 |
|
CVE-2026-92718
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templat...
|
7.3 High | — | 0,12% | 16 Sep 2026 |
|
CVE-2026-92717
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a sig...
|
9.1 Critical | — | 0,50% | 16 Sep 2026 |
|
CVE-2026-92716
Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys...
|
9.6 Critical | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92605
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access t...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92604
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlle...
|
8.1 High | — | 0,58% | 16 Sep 2026 |
|
CVE-2026-92416
A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_report_request of the file src/smf/n4-handler.c of the...
|
4.3 Medium | — | 0,53% | 16 Sep 2026 |
|
CVE-2026-92413
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stre...
|
4.3 Medium | — | 0,59% | 16 Sep 2026 |
|
CVE-2026-92406
A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments/databank/b...
|
7.3 High | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-88593
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request param...
|
6.1 Medium | — | 0,25% | 16 Sep 2026 |
|
CVE-2026-85387
concretecms concrete cms
Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. Th...
|
7.1 High | — | 0,26% | 16 Sep 2026 |
|
CVE-2026-84397
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts in...
|
5.4 Medium | — | 0,63% | 16 Sep 2026 |
|
CVE-2026-69147
vllm
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_...
|
6.5 Medium | — | 0,58% | 16 Sep 2026 |
|
CVE-2026-51990
An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component
|
9.8 Critical | — | 0,93% | 16 Sep 2026 |
|
CVE-2026-47094
SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due...
|
8.8 High | — | 0,51% | 16 Sep 2026 |
|
CVE-2026-18120
concretecms concrete cms
Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission check app...
|
5.9 Medium | — | 0,27% | 16 Sep 2026 |
|
CVE-2026-92603
ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users'...
|
6.5 Medium | — | 0,47% | 16 Sep 2026 |
|
CVE-2026-92602
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks...
|
7.1 High | — | 0,40% | 16 Sep 2026 |
|
CVE-2026-92601
Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action...
|
6.5 Medium | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-92600
Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configu...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92405
A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such...
|
7.3 High | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92402
A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserController.ja...
|
6.3 Medium | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92401
A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils.LoginUserU...
|
7.3 High | — | 0,69% | 16 Sep 2026 |
|
CVE-2026-92399
A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Ex...
|
7.3 High | — | 0,69% | 16 Sep 2026 |
|
CVE-2026-92398
A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg_config/admin of the component u...
|
9.1 Critical | — | 3,2% | 16 Sep 2026 |
|
CVE-2026-87031
concretecms concrete cms
n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) did not perfo...
|
2.7 Low | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-87028
concretecms concrete cms
Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user wa...
|
6.5 Medium | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-86359
Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially...
|
8.5 High | — | 0,32% | 16 Sep 2026 |