Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-92184
A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/ag_ui_s...
|
6.3 Medium | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-73460
On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS...
|
6.1 Medium | — | 0,20% | 16 Sep 2026 |
|
CVE-2026-73459
On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP...
|
7.4 High | — | 0,17% | 16 Sep 2026 |
|
CVE-2026-73446
On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PD...
|
7.4 High | — | 0,27% | 16 Sep 2026 |
|
CVE-2026-15640
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.
|
9.5 Critical | — | 0,28% | 16 Sep 2026 |
|
CVE-2026-15639
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.
|
9.3 Critical | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-15638
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itse...
|
9.1 Critical | — | 0,20% | 16 Sep 2026 |
|
CVE-2026-85893
microsoft edge chromium
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
|
8.8 High | — | 0,82% | 15 Sep 2026 |
|
CVE-2026-69486
microsoft edge chromium
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,82% | 15 Sep 2026 |
|
CVE-2025-11395
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of t...
|
5.5 Medium | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-92259
Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffe...
|
5.5 Medium | — | 0,14% | 15 Sep 2026 |
|
CVE-2026-92257
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board tex...
|
5.4 Medium | — | 0,24% | 15 Sep 2026 |
|
CVE-2026-92256
NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handl...
|
6.5 Medium | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-92255
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Attackers can...
|
5.4 Medium | — | 0,35% | 15 Sep 2026 |
|
CVE-2026-92248
A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occu...
|
7.8 High | — | 0,19% | 15 Sep 2026 |
|
CVE-2026-92114
A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_reg...
|
5.3 Medium | — | 0,72% | 15 Sep 2026 |
|
CVE-2026-83408
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM fo...
|
8.1 High | — | 0,42% | 15 Sep 2026 |
|
CVE-2026-83368
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version th...
|
7.0 High | — | 0,28% | 15 Sep 2026 |
|
CVE-2026-83357
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM fo...
|
8.1 High | — | 0,45% | 15 Sep 2026 |
|
CVE-2026-82567
The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over t...
|
6.3 Medium | — | 0,34% | 15 Sep 2026 |
|
CVE-2026-81855
A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard.
|
9.1 Critical | — | 0,59% | 15 Sep 2026 |
|
CVE-2026-78225
A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.
|
9.0 Critical | — | 0,51% | 15 Sep 2026 |
|
CVE-2026-76873
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostn...
|
5.2 Medium | — | 0,24% | 15 Sep 2026 |
|
CVE-2026-76872
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dh...
|
5.4 Medium | — | 0,24% | 15 Sep 2026 |
|
CVE-2026-76871
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi...
|
6.5 Medium | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-76870
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre-flash validation routine triggered by short firmware uploads. Attacke...
|
7.1 High | — | 0,40% | 15 Sep 2026 |
|
CVE-2026-76869
Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reboot_timer_set.cgi caused by improper sscanf token parsing. Attackers can exploit this flaw...
|
7.2 High | — | 0,57% | 15 Sep 2026 |
|
CVE-2026-76868
Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route_policy_add.cgi caused by a missing exit_port parameter. Attackers can send r...
|
4.9 Medium | — | 0,47% | 15 Sep 2026 |
|
CVE-2026-76867
Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing_tab_add...
|
5.4 Medium | — | 0,24% | 15 Sep 2026 |
|
CVE-2026-76866
Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enab...
|
7.2 High | — | 0,57% | 15 Sep 2026 |
|
CVE-2026-76865
Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filter_conn_del_cgi.c and gre_prio_set_cgi.c due to un...
|
4.9 Medium | — | 0,47% | 15 Sep 2026 |
|
CVE-2026-76864
NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter...
|
4.8 Medium | — | 0,25% | 15 Sep 2026 |
|
CVE-2026-76863
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the mod_qos_bandwidth plan.json handling within filter_conns_dump_cgi.c an...
|
4.3 Medium | — | 0,28% | 15 Sep 2026 |
|
CVE-2026-76862
Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tc...
|
8.8 High | — | 0,55% | 15 Sep 2026 |
|
CVE-2026-76861
Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntools_tcpdump_start_set.cgi caused by an unsized sprintf call when processing form values. A...
|
8.8 High | — | 0,68% | 15 Sep 2026 |
|
CVE-2026-76860
Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in wake_up_set.cgi caused by unbounded tokenization of MAC and ID input. Attackers can supply cr...
|
8.8 High | — | 0,55% | 15 Sep 2026 |
|
CVE-2026-76859
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi component. Low-privilege attackers can exploit this...
|
6.5 Medium | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-76858
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data. Attackers...
|
4.8 Medium | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-76857
Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns_wan_list_show.cgi endpoint and related DDNSset_cgi, IGD_...
|
6.5 Medium | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-76856
Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi e...
|
8.1 High | — | 0,19% | 15 Sep 2026 |
|
CVE-2026-76855
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7_web_auth_log_dump_cgi.c, audit_get_cgi.c...
|
6.5 Medium | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-76854
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential handling. A...
|
6.5 Medium | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-76853
Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parame_put_file.cgi restore archive prefix validation. Attackers can explo...
|
8.1 High | — | 0,26% | 15 Sep 2026 |
|
CVE-2026-76852
Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtd_write allowing forged firmware authenticity checks. Attackers can exploit put...
|
8.8 High | — | 0,27% | 15 Sep 2026 |
|
CVE-2026-73807
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected A...
|
9.8 Critical | — | 0,78% | 15 Sep 2026 |
|
CVE-2026-73444
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 ne...
|
4.7 Medium | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-73437
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a cr...
|
9.6 Critical | — | 0,21% | 15 Sep 2026 |
|
CVE-2026-61560
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authe...
|
9.8 Critical | — | 2,9% | 15 Sep 2026 |
|
CVE-2026-10144
Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacha...
|
7.8 High | — | 1,6% | 15 Sep 2026 |
|
CVE-2026-92237
Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user w...
|
6.5 Medium | — | 0,37% | 15 Sep 2026 |