Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-95638
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation...
|
7.8 High | — | — | 13 Okt 2026 |
|
CVE-2026-95637
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th...
|
7.8 High | — | — | 13 Okt 2026 |
|
CVE-2026-95636
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploit...
|
7.8 High | — | — | 13 Okt 2026 |
|
CVE-2026-95635
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit t...
|
7.8 High | — | — | 13 Okt 2026 |
|
CVE-2026-94520
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
|
4.9 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-94512
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
|
8.8 High | — | — | 13 Okt 2026 |
|
CVE-2026-93909
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
|
9.1 Critical | — | — | 13 Okt 2026 |
|
CVE-2026-93905
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instance...
|
8.2 High | — | — | 13 Okt 2026 |
|
CVE-2026-93895
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service...
|
9.1 Critical | — | — | 13 Okt 2026 |
|
CVE-2026-90530
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system rea...
|
9.3 Critical | — | — | 13 Okt 2026 |
|
CVE-2026-88089
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
|
6.7 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-88088
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | — | 13 Okt 2026 |
|
CVE-2026-88086
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.
|
5.3 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-88085
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
|
6.4 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-88084
Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network.
|
5.3 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-88083
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
|
7.5 High | — | — | 13 Okt 2026 |
|
CVE-2026-88082
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | — | 13 Okt 2026 |
|
CVE-2026-88081
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
|
7.7 High | — | — | 13 Okt 2026 |
|
CVE-2026-85919
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | — | 13 Okt 2026 |
|
CVE-2026-85888
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
|
7.7 High | — | — | 13 Okt 2026 |
|
CVE-2026-85886
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
|
8.5 High | — | — | 13 Okt 2026 |
|
CVE-2026-85876
Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | — | 13 Okt 2026 |
|
CVE-2026-85473
The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs durin...
|
5.3 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-83966
Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o...
|
7.8 High | — | — | 13 Okt 2026 |
|
CVE-2026-83965
Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit...
|
7.8 High | — | — | 13 Okt 2026 |
|
CVE-2026-83945
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
|
6.6 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-83661
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploit...
|
7.8 High | — | — | 13 Okt 2026 |
|
CVE-2026-79715
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially...
|
5.5 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-78633
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefi...
|
6.5 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-78632
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the a...
|
5.3 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-78628
The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed...
|
6.0 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-77816
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerabi...
|
6.5 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-76001
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulne...
|
7.1 High | — | — | 13 Okt 2026 |
|
CVE-2026-75996
ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerabilit...
|
7.5 High | — | — | 13 Okt 2026 |
|
CVE-2026-75995
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with hi...
|
8.4 High | — | — | 13 Okt 2026 |
|
CVE-2026-75994
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exp...
|
9.6 Critical | — | — | 13 Okt 2026 |
|
CVE-2026-75748
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit thi...
|
7.6 High | — | — | 13 Okt 2026 |
|
CVE-2026-71385
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high...
|
8.4 High | — | — | 13 Okt 2026 |
|
CVE-2026-70189
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
|
6.7 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-68883
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
|
8.5 High | — | — | 13 Okt 2026 |
|
CVE-2026-67628
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
|
4.9 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-67626
Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.
|
6.5 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-67625
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
|
8.5 High | — | — | 13 Okt 2026 |
|
CVE-2026-65674
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
|
8.8 High | — | — | 13 Okt 2026 |
|
CVE-2026-63171
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a...
|
5.4 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-63169
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlle...
|
6.4 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-63168
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitt...
|
5.4 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-63157
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an u...
|
5.4 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-63156
Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes b...
|
6.1 Medium | — | — | 13 Okt 2026 |
|
CVE-2026-62840
Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | — | 13 Okt 2026 |