Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-81736
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time con...
|
7.5 High | — | 0,57% | 16 Sep 2026 |
|
CVE-2026-81563
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If t...
|
7.5 High | — | 0,57% | 16 Sep 2026 |
|
CVE-2026-78301
A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative s...
|
5.8 Medium | — | 0,21% | 16 Sep 2026 |
|
CVE-2026-77692
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connecti...
|
7.5 High | — | 6,6% | 16 Sep 2026 |
|
CVE-2026-73177
Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in...
|
8.6 High | — | 0,15% | 16 Sep 2026 |
|
CVE-2026-61598
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.mixins.model_binding.ModelBi...
|
7.1 High | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-61590
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints exp...
|
7.4 High | — | 0,36% | 16 Sep 2026 |
|
CVE-2026-56719
MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the...
|
6.5 Medium | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-19941
An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the...
|
5.9 Medium | — | 0,23% | 16 Sep 2026 |
|
CVE-2026-19667
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 by...
|
7.5 High | — | 0,57% | 16 Sep 2026 |
|
CVE-2026-19662
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by...
|
5.9 Medium | — | 0,46% | 16 Sep 2026 |
|
CVE-2026-92361
A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go of the com...
|
4.3 Medium | — | 0,53% | 16 Sep 2026 |
|
CVE-2026-92360
A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Ap...
|
6.3 Medium | — | 0,21% | 16 Sep 2026 |
|
CVE-2026-92359
A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integrations/aws-strands/python/src...
|
3.1 Low | — | 0,27% | 16 Sep 2026 |
|
CVE-2026-88817
An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approv...
|
8.7 High | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-73176
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management i...
|
8.6 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-73175
Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V...
|
7.1 High | — | 0,26% | 16 Sep 2026 |
|
CVE-2026-73174
Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in...
|
8.7 High | — | 0,16% | 16 Sep 2026 |
|
CVE-2026-73173
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in fi...
|
8.8 High | — | 0,71% | 16 Sep 2026 |
|
CVE-2026-73172
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserver manage...
|
9.3 Critical | — | 2,2% | 16 Sep 2026 |
|
CVE-2026-73171
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version...
|
8.6 High | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-73170
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import workflow of Advantech EKI-1242E...
|
8.6 High | — | 0,54% | 16 Sep 2026 |
|
CVE-2026-73169
Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction man...
|
6.3 Medium | — | 0,54% | 16 Sep 2026 |
|
CVE-2026-73167
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management i...
|
8.6 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-73166
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management interface of Advantech EKI-1242IEI...
|
8.6 High | — | 0,70% | 16 Sep 2026 |
|
CVE-2026-73165
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management i...
|
8.6 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-73164
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management i...
|
8.6 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-73163
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management i...
|
8.6 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-19535
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advantech EKI-1242IEIMS in firmware...
|
8.6 High | — | 0,25% | 16 Sep 2026 |
|
CVE-2026-92465
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection.
This issue affects...
|
7.6 High | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-92463
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing au...
|
6.5 Medium | — | 0,46% | 16 Sep 2026 |
|
CVE-2026-92462
yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbi...
|
6.5 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92461
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to ac...
|
4.3 Medium | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-92460
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the insta...
|
6.5 Medium | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92459
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to c...
|
6.5 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92458
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify...
|
4.3 Medium | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-92457
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to is...
|
6.5 Medium | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92456
yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user...
|
7.1 High | — | 0,50% | 16 Sep 2026 |
|
CVE-2026-92455
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send...
|
4.3 Medium | — | 0,36% | 16 Sep 2026 |
|
CVE-2026-58147
WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neut...
|
9.3 Critical | — | 1,6% | 16 Sep 2026 |
|
CVE-2026-58146
WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through...
|
9.4 Critical | — | 2,9% | 16 Sep 2026 |
|
CVE-2026-40857
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_...
|
8.4 High | — | 0,20% | 16 Sep 2026 |
|
CVE-2026-40856
WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentica...
|
7.1 High | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-40855
WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifica...
|
9.3 Critical | — | 1,6% | 16 Sep 2026 |
|
CVE-2026-40854
WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the se...
|
8.7 High | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-92357
A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The mani...
|
4.3 Medium | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-92356
A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Com...
|
4.3 Medium | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-90049
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from...
|
9.3 Critical | — | 0,17% | 16 Sep 2026 |
|
CVE-2026-90048
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
ni_create_attr_list() allocates a fi...
|
9.8 Critical | — | 0,67% | 16 Sep 2026 |
|
CVE-2026-90047
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Don't hand out the flat CCS storage as usable VRAM
get_flat_ccs_offset() reads the base of t...
|
7.8 High | — | 0,17% | 16 Sep 2026 |