Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-19667
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 by...
|
7.5 High | — | 0,57% | 16 Sep 2026 |
|
CVE-2026-19662
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by...
|
5.9 Medium | — | 0,46% | 16 Sep 2026 |
|
CVE-2026-92361
A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go of the com...
|
4.3 Medium | — | 0,53% | 16 Sep 2026 |
|
CVE-2026-92360
A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Ap...
|
6.3 Medium | — | 0,21% | 16 Sep 2026 |
|
CVE-2026-92359
A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integrations/aws-strands/python/src...
|
3.1 Low | — | 0,27% | 16 Sep 2026 |
|
CVE-2026-88817
An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approv...
|
8.7 High | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-73176
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management i...
|
8.6 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-73175
Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V...
|
7.1 High | — | 0,26% | 16 Sep 2026 |
|
CVE-2026-73174
Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in...
|
8.7 High | — | 0,16% | 16 Sep 2026 |
|
CVE-2026-73173
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in fi...
|
8.8 High | — | 0,71% | 16 Sep 2026 |
|
CVE-2026-73172
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserver manage...
|
9.3 Critical | — | 2,2% | 16 Sep 2026 |
|
CVE-2026-73171
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version...
|
8.6 High | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-73170
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import workflow of Advantech EKI-1242E...
|
8.6 High | — | 0,54% | 16 Sep 2026 |
|
CVE-2026-73169
Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction man...
|
6.3 Medium | — | 0,54% | 16 Sep 2026 |
|
CVE-2026-73167
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management i...
|
8.6 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-73166
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management interface of Advantech EKI-1242IEI...
|
8.6 High | — | 0,70% | 16 Sep 2026 |
|
CVE-2026-73165
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management i...
|
8.6 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-73164
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management i...
|
8.6 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-73163
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management i...
|
8.6 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-19535
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advantech EKI-1242IEIMS in firmware...
|
8.6 High | — | 0,25% | 16 Sep 2026 |
|
CVE-2026-92465
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection.
This issue affects...
|
7.6 High | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-92463
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing au...
|
6.5 Medium | — | 0,46% | 16 Sep 2026 |
|
CVE-2026-92462
yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbi...
|
6.5 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92461
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to ac...
|
4.3 Medium | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-92460
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the insta...
|
6.5 Medium | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92459
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to c...
|
6.5 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92458
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify...
|
4.3 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-92457
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to is...
|
6.5 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92456
yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user...
|
7.1 High | — | 0,50% | 16 Sep 2026 |
|
CVE-2026-92455
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send...
|
4.3 Medium | — | 0,36% | 16 Sep 2026 |
|
CVE-2026-58147
WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neut...
|
9.3 Critical | — | 1,6% | 16 Sep 2026 |
|
CVE-2026-58146
WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through...
|
9.4 Critical | — | 2,9% | 16 Sep 2026 |
|
CVE-2026-40857
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_...
|
8.4 High | — | 0,20% | 16 Sep 2026 |
|
CVE-2026-40856
WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentica...
|
7.1 High | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-40855
WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifica...
|
9.3 Critical | — | 1,6% | 16 Sep 2026 |
|
CVE-2026-40854
WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the se...
|
8.7 High | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-92357
A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The mani...
|
4.3 Medium | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-92356
A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Com...
|
4.3 Medium | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-90049
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from...
|
9.3 Critical | — | 0,17% | 16 Sep 2026 |
|
CVE-2026-90048
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
ni_create_attr_list() allocates a fi...
|
9.8 Critical | — | 0,67% | 16 Sep 2026 |
|
CVE-2026-90047
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Don't hand out the flat CCS storage as usable VRAM
get_flat_ccs_offset() reads the base of t...
|
7.8 High | — | 0,17% | 16 Sep 2026 |
|
CVE-2026-90046
In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: don't spin_trylock() in NMI on UP
Patch series "mm/page_alloc: fixes for free_pages_n...
|
7.8 High | — | 0,17% | 16 Sep 2026 |
|
CVE-2026-90045
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: ffs: fix mm lifetime handling
io_data stores a pointer to the submitting task's mm_stru...
|
7.8 High | — | 0,17% | 16 Sep 2026 |
|
CVE-2026-90044
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
In ffs_epfile_write_iter() and ffs_epfile_re...
|
7.8 High | — | 0,17% | 16 Sep 2026 |
|
CVE-2026-90043
In the Linux kernel, the following vulnerability has been resolved:
zram: fix slot lock bit position on big-endian 64-bit
The slot lock is a bit operation on the whole...
|
7.8 High | — | 0,17% | 16 Sep 2026 |
|
CVE-2026-90042
In the Linux kernel, the following vulnerability has been resolved:
ceph: properly decrypt filenames in vmalloc() buffers
The fscrypt subsystem uses the scatterlist cry...
|
9.8 Critical | — | 0,50% | 16 Sep 2026 |
|
CVE-2026-90041
In the Linux kernel, the following vulnerability has been resolved:
HID: sony: clean up device list on probe failure
sony_input_configured() adds some controllers to so...
|
8.8 High | — | 0,30% | 16 Sep 2026 |
|
CVE-2026-90038
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during export state revocation
nfsd4_revoke_export_states() has...
|
9.8 Critical | — | 0,55% | 16 Sep 2026 |
|
CVE-2026-90037
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during close_lru reaping
An nfs4_openowner left on nn->close_lru...
|
9.8 Critical | — | 0,48% | 16 Sep 2026 |
|
CVE-2026-90036
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during blocked-lock reaping
A bare lock owner -- its only remain...
|
9.8 Critical | — | 0,47% | 16 Sep 2026 |