Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-92406
A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments/databank/b...
|
7.3 High | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-88593
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request param...
|
6.1 Medium | — | 0,25% | 16 Sep 2026 |
|
CVE-2026-85387
concretecms concrete cms
Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. Th...
|
7.1 High | — | 0,26% | 16 Sep 2026 |
|
CVE-2026-84397
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts in...
|
5.4 Medium | — | 0,63% | 16 Sep 2026 |
|
CVE-2026-69147
vllm
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_...
|
6.5 Medium | — | 0,58% | 16 Sep 2026 |
|
CVE-2026-51990
An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component
|
9.8 Critical | — | 0,93% | 16 Sep 2026 |
|
CVE-2026-47094
SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due...
|
8.8 High | — | 0,51% | 16 Sep 2026 |
|
CVE-2026-18120
concretecms concrete cms
Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission check app...
|
5.9 Medium | — | 0,27% | 16 Sep 2026 |
|
CVE-2026-92603
ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users'...
|
6.5 Medium | — | 0,47% | 16 Sep 2026 |
|
CVE-2026-92602
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks...
|
7.1 High | — | 0,40% | 16 Sep 2026 |
|
CVE-2026-92601
Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action...
|
6.5 Medium | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-92600
Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configu...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92405
A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such...
|
7.3 High | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92402
A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserController.ja...
|
6.3 Medium | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92401
A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils.LoginUserU...
|
7.3 High | — | 0,69% | 16 Sep 2026 |
|
CVE-2026-92399
A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Ex...
|
7.3 High | — | 0,69% | 16 Sep 2026 |
|
CVE-2026-92398
A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg_config/admin of the component u...
|
9.1 Critical | — | 3,2% | 16 Sep 2026 |
|
CVE-2026-87031
concretecms concrete cms
n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) did not perfo...
|
2.7 Low | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-87028
concretecms concrete cms
Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user wa...
|
6.5 Medium | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-86359
Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially...
|
8.5 High | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-86358
dell update package framework
Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access...
|
8.8 High | — | 0,41% | 16 Sep 2026 |
|
CVE-2026-85756
SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the...
|
7.5 High | — | 0,62% | 16 Sep 2026 |
|
CVE-2026-85732
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled...
|
4.7 Medium | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-85731
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write out...
|
8.8 High | — | 0,68% | 16 Sep 2026 |
|
CVE-2026-85386
concretecms concrete cms
Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file exte...
|
6.1 Medium | — | 0,24% | 16 Sep 2026 |
|
CVE-2026-85385
concretecms concrete cms
Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management page, wher...
|
9.6 Critical | — | 0,50% | 16 Sep 2026 |
|
CVE-2026-84993
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validates the field...
|
6.5 Medium | — | 0,51% | 16 Sep 2026 |
|
CVE-2026-76420
A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attac...
|
9.0 Critical | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-71182
dell update package framework
Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high privileged att...
|
6.0 Medium | — | 0,15% | 16 Sep 2026 |
|
CVE-2026-71181
dell update package framework
Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high privileged att...
|
6.0 Medium | — | 0,15% | 16 Sep 2026 |
|
CVE-2026-71180
dell update package framework
Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially...
|
7.8 High | — | 0,15% | 16 Sep 2026 |
|
CVE-2026-71179
dell update package framework
Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab...
|
7.8 High | — | 0,59% | 16 Sep 2026 |
|
CVE-2026-69200
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/sour...
|
3.7 Low | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-68904
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a rep...
|
7.0 High | — | 0,44% | 16 Sep 2026 |
|
CVE-2026-59974
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip...
|
7.8 High | — | 0,40% | 16 Sep 2026 |
|
CVE-2026-59944
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE...
|
6.1 Medium | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-57173
vllm
vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes o...
|
6.5 Medium | — | 0,73% | 16 Sep 2026 |
|
CVE-2026-42784
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in ho...
|
7.4 High | — | 0,31% | 16 Sep 2026 |
|
CVE-2026-20331
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defen...
|
9.6 Critical | — | 0,23% | 16 Sep 2026 |
|
CVE-2026-20307
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating...
|
9.9 Critical | — | 0,96% | 16 Sep 2026 |
|
CVE-2026-20306
A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating sy...
|
9.1 Critical | — | 1,4% | 16 Sep 2026 |
|
CVE-2026-20305
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying oper...
|
9.1 Critical | — | 1,4% | 16 Sep 2026 |
|
CVE-2026-20234
cisco identity services engine, cisco identity services engine passive identity connector
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PI...
|
9.9 Critical | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92627
A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point member...
|
4.6 Medium | — | 0,23% | 16 Sep 2026 |
|
CVE-2026-92626
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/dguardintegration/dguardVersion endpoint dereferences DGuar...
|
7.5 High | — | 0,46% | 16 Sep 2026 |
|
CVE-2026-92625
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/license/restartService endpoint is reachable without authen...
|
7.5 High | — | 0,66% | 16 Sep 2026 |
|
CVE-2026-92615
A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerif...
|
6.6 Medium | — | 0,16% | 16 Sep 2026 |
|
CVE-2026-92397
A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file unifyframe-sgi.elf of the compone...
|
9.1 Critical | — | 3,2% | 16 Sep 2026 |
|
CVE-2026-92385
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update_category.php of th...
|
2.4 Low | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-90999
Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent...
|
9.8 Critical | — | 0,67% | 16 Sep 2026 |