Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-92940
vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). Th...
|
10.0 Critical | — | 0,47% | 17 Sep 2026 |
|
CVE-2026-92939
vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only...
|
9.9 Critical | — | 0,62% | 17 Sep 2026 |
|
CVE-2026-92938
vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin...
|
9.9 Critical | — | 0,62% | 17 Sep 2026 |
|
CVE-2026-92937
vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate...
|
10.0 Critical | — | 1,0% | 17 Sep 2026 |
|
CVE-2026-92936
vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm s...
|
5.8 Medium | — | 0,46% | 17 Sep 2026 |
|
CVE-2026-92935
vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts...
|
9.0 Critical | — | 0,67% | 17 Sep 2026 |
|
CVE-2026-92934
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within...
|
9.0 Critical | — | 0,76% | 17 Sep 2026 |
|
CVE-2026-92933
vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.as...
|
5.8 Medium | — | 0,37% | 17 Sep 2026 |
|
CVE-2026-92879
A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resour...
|
4.3 Medium | — | 0,59% | 17 Sep 2026 |
|
CVE-2026-90986
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.
|
7.1 High | — | 0,25% | 17 Sep 2026 |
|
CVE-2026-90887
Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.
|
7.1 High | — | 0,25% | 17 Sep 2026 |
|
CVE-2026-89418
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire...
|
8.7 High | — | 0,28% | 17 Sep 2026 |
|
CVE-2026-86533
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.
A r...
|
9.1 Critical | — | 0,91% | 17 Sep 2026 |
|
CVE-2026-86522
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting...
|
6.3 Medium | — | 0,74% | 17 Sep 2026 |
|
CVE-2026-85500
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email conf...
|
9.1 Critical | — | 0,77% | 17 Sep 2026 |
|
CVE-2026-82761
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use...
|
9.1 Critical | — | 0,56% | 17 Sep 2026 |
|
CVE-2026-82760
Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 se...
|
8.2 High | — | 0,74% | 17 Sep 2026 |
|
CVE-2026-82759
Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that th...
|
1.8 Low | — | 0,14% | 17 Sep 2026 |
|
CVE-2026-82723
Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store....
|
1.8 Low | — | 0,18% | 17 Sep 2026 |
|
CVE-2026-82685
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's...
|
7.6 High | — | 0,66% | 17 Sep 2026 |
|
CVE-2026-81829
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB k...
|
5.3 Medium | — | 0,59% | 17 Sep 2026 |
|
CVE-2026-81637
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and si...
|
2.3 Low | — | 0,61% | 17 Sep 2026 |
|
CVE-2026-81632
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser hist...
|
7.2 High | — | 0,21% | 17 Sep 2026 |
|
CVE-2026-81453
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability...
|
6.5 Medium | — | 0,45% | 17 Sep 2026 |
|
CVE-2026-81443
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote acces...
|
6.4 Medium | — | 0,23% | 17 Sep 2026 |
|
CVE-2026-81442
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access co...
|
8.1 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-80355
dell openmanage server administrator
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote acce...
|
5.4 Medium | — | 0,21% | 17 Sep 2026 |
|
CVE-2026-80218
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a use...
|
7.6 High | — | 0,64% | 17 Sep 2026 |
|
CVE-2026-78528
Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.
|
5.3 Medium | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-78295
Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions.
|
8.8 High | — | 0,20% | 17 Sep 2026 |
|
CVE-2026-78294
Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-78223
Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation...
|
6.9 Medium | — | 0,44% | 17 Sep 2026 |
|
CVE-2026-74017
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
|
5.3 Medium | — | 0,31% | 17 Sep 2026 |
|
CVE-2026-74005
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
|
5.4 Medium | — | 0,14% | 17 Sep 2026 |
|
CVE-2026-74002
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
|
5.3 Medium | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-74000
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
|
5.3 Medium | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-73999
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
|
5.4 Medium | — | 0,29% | 17 Sep 2026 |
|
CVE-2026-71568
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which red...
|
5.3 Medium | — | 0,23% | 17 Sep 2026 |
|
CVE-2026-66676
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
|
5.3 Medium | — | 0,31% | 17 Sep 2026 |
|
CVE-2026-66631
Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66630
Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66628
Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66626
Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66625
Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66624
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66619
Administrator SQL Injection in Newsletters <= 4.18 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66618
Administrator SQL Injection in WP Maps <= 4.9.9 versions.
|
7.6 High | — | 0,38% | 17 Sep 2026 |
|
CVE-2026-66617
Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
|
6.5 Medium | — | 0,22% | 17 Sep 2026 |
|
CVE-2026-66608
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
|
6.4 Medium | — | 0,23% | 17 Sep 2026 |
|
CVE-2026-66580
Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.
|
8.5 High | — | 0,36% | 17 Sep 2026 |