Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-71179
dell update package framework
Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab...
|
7.8 High | — | 0,59% | 16 Sep 2026 |
|
CVE-2026-69200
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/sour...
|
3.7 Low | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-68904
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a rep...
|
7.0 High | — | 0,44% | 16 Sep 2026 |
|
CVE-2026-59974
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip...
|
7.8 High | — | 0,40% | 16 Sep 2026 |
|
CVE-2026-59944
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE...
|
6.1 Medium | — | 0,32% | 16 Sep 2026 |
|
CVE-2026-57173
vllm
vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes o...
|
6.5 Medium | — | 0,73% | 16 Sep 2026 |
|
CVE-2026-42784
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in ho...
|
7.4 High | — | 0,31% | 16 Sep 2026 |
|
CVE-2026-20331
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defen...
|
9.6 Critical | — | 0,23% | 16 Sep 2026 |
|
CVE-2026-20307
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating...
|
9.9 Critical | — | 0,96% | 16 Sep 2026 |
|
CVE-2026-20306
A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating sy...
|
9.1 Critical | — | 1,4% | 16 Sep 2026 |
|
CVE-2026-20305
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying oper...
|
9.1 Critical | — | 1,4% | 16 Sep 2026 |
|
CVE-2026-20234
cisco identity services engine, cisco identity services engine passive identity connector
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PI...
|
9.9 Critical | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-92627
A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point member...
|
4.6 Medium | — | 0,23% | 16 Sep 2026 |
|
CVE-2026-92626
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/dguardintegration/dguardVersion endpoint dereferences DGuar...
|
7.5 High | — | 0,46% | 16 Sep 2026 |
|
CVE-2026-92625
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/license/restartService endpoint is reachable without authen...
|
7.5 High | — | 0,66% | 16 Sep 2026 |
|
CVE-2026-92615
A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerif...
|
6.6 Medium | — | 0,16% | 16 Sep 2026 |
|
CVE-2026-92397
A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file unifyframe-sgi.elf of the compone...
|
9.1 Critical | — | 3,2% | 16 Sep 2026 |
|
CVE-2026-92385
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update_category.php of th...
|
2.4 Low | — | 0,38% | 16 Sep 2026 |
|
CVE-2026-90999
Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent...
|
9.8 Critical | — | 0,67% | 16 Sep 2026 |
|
CVE-2026-76104
dell objectscale
Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attacker with re...
|
5.5 Medium | — | 0,36% | 16 Sep 2026 |
|
CVE-2026-70416
dell objectscale
Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially...
|
9.8 Critical | — | 0,85% | 16 Sep 2026 |
|
CVE-2026-61595
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.tenants` isolation was enfor...
|
7.7 High | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-61593
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoint...
|
8.1 High | — | 0,21% | 16 Sep 2026 |
|
CVE-2026-26947
Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulnerability. A high privileged atta...
|
6.7 Medium | — | 0,15% | 16 Sep 2026 |
|
CVE-2026-19607
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs...
|
5.3 Medium | — | 0,51% | 16 Sep 2026 |
|
CVE-2026-17526
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm admini...
|
7.2 High | — | 0,45% | 16 Sep 2026 |
|
CVE-2025-59953
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc...
|
9.8 Critical | — | 0,80% | 16 Sep 2026 |
|
CVE-2025-43936
dell objectscale
Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potential...
|
9.1 Critical | — | 0,48% | 16 Sep 2026 |
|
CVE-2026-92616
FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access...
|
6.8 Medium | — | 0,39% | 16 Sep 2026 |
|
CVE-2026-92570
reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool con...
|
6.5 Medium | — | 0,44% | 16 Sep 2026 |
|
CVE-2026-92569
Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authe...
|
4.3 Medium | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-92568
MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send a...
|
5.4 Medium | — | 0,33% | 16 Sep 2026 |
|
CVE-2026-92567
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwr...
|
6.5 Medium | — | 0,42% | 16 Sep 2026 |
|
CVE-2026-92566
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitra...
|
8.2 High | — | 0,54% | 16 Sep 2026 |
|
CVE-2026-92565
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to un...
|
5.3 Medium | — | 0,46% | 16 Sep 2026 |
|
CVE-2026-92395
@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In ver...
|
9.1 Critical | — | 0,33% | 16 Sep 2026 |
|
CVE-2026-92383
A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admi...
|
4.3 Medium | — | 0,24% | 16 Sep 2026 |
|
CVE-2026-92381
A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the co...
|
3.5 Low | — | 0,35% | 16 Sep 2026 |
|
CVE-2026-92380
A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Re...
|
7.3 High | — | 0,50% | 16 Sep 2026 |
|
CVE-2026-92366
A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. This manipul...
|
7.3 High | — | 0,56% | 16 Sep 2026 |
|
CVE-2026-92087
@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when stra...
|
8.1 High | — | 0,48% | 16 Sep 2026 |
|
CVE-2026-89031
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX han...
|
5.4 Medium | — | 0,30% | 16 Sep 2026 |
|
CVE-2026-88976
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization A...
|
6.1 Medium | — | 0,34% | 16 Sep 2026 |
|
CVE-2026-88064
linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage
Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently va...
|
8.8 High | — | 1,2% | 16 Sep 2026 |
|
CVE-2026-84997
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite...
|
7.5 High | — | 0,66% | 16 Sep 2026 |
|
CVE-2026-84860
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass
Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches meth...
|
8.8 High | — | 0,48% | 16 Sep 2026 |
|
CVE-2026-84859
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection
The /api/events/search endpoint accepts a JSON body containing a sortBy ar...
|
6.5 Medium | — | 0,37% | 16 Sep 2026 |
|
CVE-2026-84858
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass
The DWR "DataSourceEditDwr" class exposes t...
|
8.8 High | — | 0,84% | 16 Sep 2026 |
|
CVE-2026-82964
Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox t...
|
8.8 High | — | 0,16% | 16 Sep 2026 |
|
CVE-2026-82410
Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not intern...
|
8.7 High | — | 0,58% | 16 Sep 2026 |