Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-95667
The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_...
|
6.9 Medium | — | 0,18% | 22 Sep 2026 |
|
CVE-2026-95666
mattermost server
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions...
|
4.3 Medium | — | 0,37% | 22 Sep 2026 |
|
CVE-2026-95665
MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSear...
|
5.1 Medium | — | 0,54% | 22 Sep 2026 |
|
CVE-2026-95499
A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_uploaded_file of the file filemanager.php. Executin...
|
7.3 High | — | 0,47% | 22 Sep 2026 |
|
CVE-2026-95396
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java...
|
4.3 Medium | — | 0,47% | 22 Sep 2026 |
|
CVE-2026-93343
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated at...
|
6.5 Medium | — | 0,40% | 22 Sep 2026 |
|
CVE-2026-93342
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated att...
|
5.4 Medium | — | 0,32% | 22 Sep 2026 |
|
CVE-2026-93341
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers...
|
4.3 Medium | — | 0,33% | 22 Sep 2026 |
|
CVE-2026-12718
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL I...
|
9.8 Critical | — | 0,32% | 22 Sep 2026 |
|
CVE-2026-95661
MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segmen...
|
5.1 Medium | — | 0,44% | 22 Sep 2026 |
|
CVE-2026-95659
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter...
|
4.8 Medium | — | 0,39% | 22 Sep 2026 |
|
CVE-2026-95658
MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions...
|
6.9 Medium | — | 0,27% | 22 Sep 2026 |
|
CVE-2026-95619
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to...
|
7.7 High | — | 0,36% | 22 Sep 2026 |
|
CVE-2026-95273
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py of the com...
|
4.3 Medium | — | 0,52% | 22 Sep 2026 |
|
CVE-2026-95272
A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_content of the file changedetectionio/flask_app.py of the componen...
|
3.7 Low | — | 0,67% | 22 Sep 2026 |
|
CVE-2026-95271
A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function check_authentication of the file changedetectionio/flask_...
|
7.3 High | — | 0,65% | 22 Sep 2026 |
|
CVE-2026-93616
Advisory
checkpoint multi-domain security management
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
|
9.8 Critical | KEV | 75,9% | 22 Sep 2026 |
|
CVE-2026-75791
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.
|
8.6 High | — | 1,8% | 22 Sep 2026 |
|
CVE-2026-95270
A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the c...
|
3.7 Low | — | 0,44% | 22 Sep 2026 |
|
CVE-2026-89420
Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.
MPP.Ses...
|
7.1 High | — | 0,41% | 22 Sep 2026 |
|
CVE-2026-87119
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly.
The payer...
|
8.2 High | — | 0,57% | 22 Sep 2026 |
|
CVE-2026-74849
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.
|
9.8 Critical | — | 4,6% | 22 Sep 2026 |
|
CVE-2026-63279
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette inde...
|
5.4 Medium | — | 0,15% | 22 Sep 2026 |
|
CVE-2026-63278
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening...
|
6.7 Medium | — | 0,14% | 22 Sep 2026 |
|
CVE-2026-63276
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buf...
|
5.4 Medium | — | 0,19% | 22 Sep 2026 |
|
CVE-2026-63275
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked aga...
|
5.4 Medium | — | 0,19% | 22 Sep 2026 |
|
CVE-2026-63274
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own diction...
|
5.4 Medium | — | 0,19% | 22 Sep 2026 |
|
CVE-2026-63273
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the docume...
|
5.4 Medium | — | 0,12% | 22 Sep 2026 |
|
CVE-2026-63272
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advanc...
|
5.4 Medium | — | 0,20% | 22 Sep 2026 |
|
CVE-2026-95623
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds wit...
|
5.6 Medium | — | 0,24% | 22 Sep 2026 |
|
CVE-2026-92882
Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an a...
|
5.3 Medium | — | 0,35% | 22 Sep 2026 |
|
CVE-2026-90990
Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional L...
|
5.3 Medium | — | 0,42% | 22 Sep 2026 |
|
CVE-2026-94117
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injec...
|
7.6 High | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-90882
The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticate...
|
8.7 High | — | 0,44% | 22 Sep 2026 |
|
CVE-2026-25265
qualcomm software center
Privilege escalation due to weak configuration while temporary file handling.
|
8.8 High | — | 0,08% | 22 Sep 2026 |
|
CVE-2026-25264
qualcomm software center
Privilege escalation due to weak configuration during package extraction process.
|
8.8 High | — | 0,08% | 22 Sep 2026 |
|
CVE-2026-25262
qualcomm mdm9207 firmware, qualcomm mdm9655 firmware +6 lainnya
Memory corruption while processing a crafted ELF file in the Primary Bootloader.
|
6.3 Medium | — | 0,14% | 22 Sep 2026 |
|
CVE-2026-25255
qualcomm package manager, qualcomm software center
Exposed dangerous function lead to privilege escalation via gRPC server.
|
7.8 High | — | 0,08% | 22 Sep 2026 |
|
CVE-2026-25254
qualcomm software center
Improper authorization leads to Remote Code Execution via SocketIO interface.
|
9.8 Critical | — | 0,32% | 22 Sep 2026 |
|
CVE-2026-95508
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCP...
|
7.4 High | — | 0,57% | 22 Sep 2026 |
|
CVE-2026-9231
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0...
|
7.5 High | — | 0,58% | 22 Sep 2026 |
|
CVE-2026-93928
Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass.
This issue a...
|
7.3 High | — | 0,40% | 22 Sep 2026 |
|
CVE-2026-93556
The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery...
|
9.3 Critical | — | 0,31% | 22 Sep 2026 |
|
CVE-2026-89422
Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pr...
|
9.3 Critical | — | 0,46% | 22 Sep 2026 |
|
CVE-2026-68956
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening...
|
7.1 High | — | 0,38% | 22 Sep 2026 |
|
CVE-2026-65634
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a craft...
|
8.2 High | — | 0,27% | 22 Sep 2026 |
|
CVE-2026-15095
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up...
|
4.9 Medium | — | 1,1% | 22 Sep 2026 |
|
CVE-2026-95503
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used wi...
|
6.8 Medium | — | 0,19% | 22 Sep 2026 |
|
CVE-2026-93952
Advisory
arista velocloud orchestrator
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host...
|
10.0 Critical | KEV | 1,1% | 22 Sep 2026 |
|
CVE-2026-9004
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the '...
|
4.3 Medium | — | 0,37% | 22 Sep 2026 |