Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-92578
WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent co...
|
8.1 High | — | 0,62% | 16 Sep 2026 |
|
CVE-2026-92577
In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos...
|
7.5 High | — | 0,43% | 16 Sep 2026 |
|
CVE-2026-92576
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block internal I...
|
8.6 High | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-89034
TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby a...
|
6.5 Medium | — | 0,33% | 16 Sep 2026 |
|
CVE-2026-85469
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, w...
|
8.0 High | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-64684
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/st...
|
6.8 Medium | — | 0,50% | 16 Sep 2026 |
|
CVE-2026-61597
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component templ...
|
5.1 Medium | — | 0,41% | 16 Sep 2026 |
|
CVE-2026-61594
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport auth...
|
9.1 Critical | — | 0,49% | 16 Sep 2026 |
|
CVE-2026-61592
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a...
|
7.4 High | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-61591
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snaps...
|
8.1 High | — | 0,22% | 16 Sep 2026 |
|
CVE-2026-92816
ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attack...
|
7.8 High | — | 0,20% | 16 Sep 2026 |
|
CVE-2026-92815
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can s...
|
7.5 High | — | 0,54% | 16 Sep 2026 |
|
CVE-2026-92814
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup...
|
4.2 Medium | — | 0,30% | 16 Sep 2026 |
|
CVE-2026-92813
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services....
|
4.9 Medium | — | 0,47% | 16 Sep 2026 |
|
CVE-2026-92812
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Atta...
|
6.8 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92811
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbi...
|
6.5 Medium | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92810
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tok...
|
4.3 Medium | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-92809
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit a...
|
4.3 Medium | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-92806
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrato...
|
8.1 High | — | 0,26% | 16 Sep 2026 |
|
CVE-2026-92805
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated...
|
9.8 Critical | — | 0,64% | 16 Sep 2026 |
|
CVE-2026-92804
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers c...
|
7.1 High | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92803
LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API...
|
5.3 Medium | — | 0,53% | 16 Sep 2026 |
|
CVE-2026-92802
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:crea...
|
4.3 Medium | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92801
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent com...
|
8.8 High | — | 0,55% | 16 Sep 2026 |
|
CVE-2026-92800
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-t...
|
6.8 Medium | — | 0,41% | 16 Sep 2026 |
|
CVE-2026-92796
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauth...
|
8.8 High | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-92795
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal service...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92794
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a docume...
|
7.5 High | — | 0,59% | 16 Sep 2026 |
|
CVE-2026-92793
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a quer...
|
8.1 High | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92792
OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a test_purpose key, causing the FallbackVerifier t...
|
7.5 High | — | 0,60% | 16 Sep 2026 |
|
CVE-2026-92791
Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage...
|
7.5 High | — | 0,61% | 16 Sep 2026 |
|
CVE-2026-92790
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypass...
|
6.5 Medium | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-92789
Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects. Attackers with lookup t...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92788
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate p...
|
8.8 High | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-92787
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an u...
|
9.8 Critical | — | 0,70% | 16 Sep 2026 |
|
CVE-2026-92786
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. A...
|
7.8 High | — | 0,19% | 16 Sep 2026 |
|
CVE-2026-92785
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can ins...
|
8.1 High | — | 0,61% | 16 Sep 2026 |
|
CVE-2026-92784
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can in...
|
7.5 High | — | 0,48% | 16 Sep 2026 |
|
CVE-2026-92783
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships....
|
8.1 High | — | 0,50% | 16 Sep 2026 |
|
CVE-2026-92782
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants...
|
8.1 High | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92781
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query p...
|
6.3 Medium | — | 0,36% | 16 Sep 2026 |
|
CVE-2026-92780
KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers...
|
8.8 High | — | 0,52% | 16 Sep 2026 |
|
CVE-2026-92779
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings...
|
7.6 High | — | 0,49% | 16 Sep 2026 |
|
CVE-2026-92778
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access...
|
5.4 Medium | — | 0,44% | 16 Sep 2026 |
|
CVE-2026-92776
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folde...
|
8.1 High | — | 0,45% | 16 Sep 2026 |
|
CVE-2026-92775
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92774
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can quer...
|
4.3 Medium | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92773
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim anothe...
|
7.1 High | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-92772
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limite...
|
7.1 High | — | 0,53% | 16 Sep 2026 |
|
CVE-2026-92771
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. A...
|
6.5 Medium | — | 0,44% | 16 Sep 2026 |