Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-92816
ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attack...
|
7.8 High | — | 0,20% | 16 Sep 2026 |
|
CVE-2026-92815
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can s...
|
7.5 High | — | 0,54% | 16 Sep 2026 |
|
CVE-2026-92814
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup...
|
4.2 Medium | — | 0,30% | 16 Sep 2026 |
|
CVE-2026-92813
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services....
|
4.9 Medium | — | 0,47% | 16 Sep 2026 |
|
CVE-2026-92812
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Atta...
|
6.8 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92811
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbi...
|
6.5 Medium | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92810
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tok...
|
4.3 Medium | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-92809
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit a...
|
4.3 Medium | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-92806
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrato...
|
8.1 High | — | 0,26% | 16 Sep 2026 |
|
CVE-2026-92805
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated...
|
9.8 Critical | — | 0,64% | 16 Sep 2026 |
|
CVE-2026-92804
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers c...
|
7.1 High | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92803
LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API...
|
5.3 Medium | — | 0,53% | 16 Sep 2026 |
|
CVE-2026-92802
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:crea...
|
4.3 Medium | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92801
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent com...
|
8.8 High | — | 0,55% | 16 Sep 2026 |
|
CVE-2026-92800
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-t...
|
6.8 Medium | — | 0,41% | 16 Sep 2026 |
|
CVE-2026-92796
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauth...
|
8.8 High | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-92795
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal service...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92794
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a docume...
|
7.5 High | — | 0,59% | 16 Sep 2026 |
|
CVE-2026-92793
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a quer...
|
8.1 High | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92792
OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a test_purpose key, causing the FallbackVerifier t...
|
7.5 High | — | 0,60% | 16 Sep 2026 |
|
CVE-2026-92791
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage...
|
7.5 High | — | 0,61% | 16 Sep 2026 |
|
CVE-2026-92790
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypass...
|
6.5 Medium | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-92789
Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup t...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92788
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate p...
|
8.8 High | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-92787
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an u...
|
9.8 Critical | — | 0,70% | 16 Sep 2026 |
|
CVE-2026-92786
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. A...
|
7.8 High | — | 0,19% | 16 Sep 2026 |
|
CVE-2026-92785
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can ins...
|
8.1 High | — | 0,61% | 16 Sep 2026 |
|
CVE-2026-92784
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can in...
|
7.5 High | — | 0,48% | 16 Sep 2026 |
|
CVE-2026-92783
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships....
|
8.1 High | — | 0,50% | 16 Sep 2026 |
|
CVE-2026-92782
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants...
|
8.1 High | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92781
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query p...
|
6.3 Medium | — | 0,36% | 16 Sep 2026 |
|
CVE-2026-92780
KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers...
|
8.8 High | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-92779
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings...
|
7.6 High | — | 0,49% | 16 Sep 2026 |
|
CVE-2026-92778
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access...
|
5.4 Medium | — | 0,44% | 16 Sep 2026 |
|
CVE-2026-92776
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folde...
|
8.1 High | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92775
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92774
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can quer...
|
4.3 Medium | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92773
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim anothe...
|
7.1 High | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-92772
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limite...
|
7.1 High | — | 0,53% | 16 Sep 2026 |
|
CVE-2026-92771
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. A...
|
6.5 Medium | — | 0,44% | 16 Sep 2026 |
|
CVE-2026-92770
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filt...
|
6.5 Medium | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92765
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other...
|
6.5 Medium | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92764
OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships....
|
4.3 Medium | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92763
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the impor...
|
8.1 High | — | 0,62% | 16 Sep 2026 |
|
CVE-2026-92762
Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers w...
|
8.8 High | — | 0,65% | 16 Sep 2026 |
|
CVE-2026-92761
WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants c...
|
8.8 High | — | 0,61% | 16 Sep 2026 |
|
CVE-2026-92760
Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers w...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92759
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from...
|
6.5 Medium | — | 0,46% | 16 Sep 2026 |
|
CVE-2026-92754
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authen...
|
4.3 Medium | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-92753
PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers...
|
7.1 High | — | 0,38% | 16 Sep 2026 |