Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-19886
OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af...
|
7.8 High | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-19885
OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...
|
7.8 High | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-19781
Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code...
|
7.8 High | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-19774
BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected ins...
|
7.1 High | — | 0,27% | 15 Sep 2026 |
|
CVE-2026-19773
libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co...
|
9.8 Critical | — | 0,65% | 15 Sep 2026 |
|
CVE-2026-19641
On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploit...
|
5.3 Medium | — | 0,34% | 15 Sep 2026 |
|
CVE-2026-19504
Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations o...
|
4.0 Medium | — | 0,12% | 15 Sep 2026 |
|
CVE-2026-18421
Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, update_data_source, and dele...
|
2.1 Low | — | 0,27% | 15 Sep 2026 |
|
CVE-2026-0200
google android
In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution p...
|
8.8 High | — | 0,29% | 15 Sep 2026 |
|
CVE-2026-0199
google android
In gf_ta_test_set_config of gf_ta_test.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with...
|
7.8 High | — | 0,07% | 15 Sep 2026 |
|
CVE-2026-0197
google android
In VPU, there is a possible information dislclosure due to a logic error in the code. This could lead to local information disclosure with System execution privileges nee...
|
4.4 Medium | — | 0,08% | 15 Sep 2026 |
|
CVE-2026-0194
google android
In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege with no additional execution pri...
|
8.4 High | — | 0,08% | 15 Sep 2026 |
|
CVE-2026-0192
google android
In Bootloader, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System execution privi...
|
6.7 Medium | — | 0,07% | 15 Sep 2026 |
|
CVE-2026-0189
google android
In ac_init_policy of init.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional e...
|
8.4 High | — | 0,08% | 15 Sep 2026 |
|
CVE-2026-0187
google android
In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privil...
|
6.7 Medium | — | 0,08% | 15 Sep 2026 |
|
CVE-2026-0186
google android
In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System...
|
6.7 Medium | — | 0,08% | 15 Sep 2026 |
|
CVE-2026-0183
google android
In CPM, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with System execution privileges needed. User...
|
4.4 Medium | — | 0,07% | 15 Sep 2026 |
|
CVE-2026-0179
google android
In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges...
|
6.7 Medium | — | 0,07% | 15 Sep 2026 |
|
CVE-2026-0177
google android
In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with Syste...
|
4.4 Medium | — | 0,07% | 15 Sep 2026 |
|
CVE-2026-0171
google android
In multiple locations, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution pri...
|
8.8 High | — | 0,29% | 15 Sep 2026 |
|
CVE-2026-0170
google android
In Vp9DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with n...
|
8.8 High | — | 0,28% | 15 Sep 2026 |
|
CVE-2026-0159
google android
In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges...
|
8.8 High | — | 0,28% | 15 Sep 2026 |
|
CVE-2026-88765
gitlab
GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an...
|
8.5 High | — | 0,68% | 15 Sep 2026 |
|
CVE-2026-85234
A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid...
|
7.5 High | — | 0,47% | 15 Sep 2026 |
|
CVE-2026-82837
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could...
|
4.3 Medium | — | 0,23% | 15 Sep 2026 |
|
CVE-2026-81899
Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stored cross-si...
|
7.3 High | — | 0,48% | 15 Sep 2026 |
|
CVE-2026-81898
In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user a...
|
7.5 High | — | 0,44% | 15 Sep 2026 |
|
CVE-2026-81240
dell wyse management suite
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with rem...
|
9.8 Critical | — | 0,40% | 15 Sep 2026 |
|
CVE-2026-81239
dell wyse management suite
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with rem...
|
9.8 Critical | — | 0,40% | 15 Sep 2026 |
|
CVE-2026-81238
dell wyse management suite
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote...
|
9.1 Critical | — | 0,27% | 15 Sep 2026 |
|
CVE-2026-81237
dell wyse management suite
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potenti...
|
6.5 Medium | — | 0,34% | 15 Sep 2026 |
|
CVE-2026-81236
dell wyse management suite
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with rem...
|
9.8 Critical | — | 0,41% | 15 Sep 2026 |
|
CVE-2026-81235
dell wyse management suite
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. A high privileged attacker with remote access could potent...
|
4.9 Medium | — | 0,24% | 15 Sep 2026 |
|
CVE-2026-61668
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapp...
|
8.1 High | — | 0,40% | 15 Sep 2026 |
|
CVE-2026-61667
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandl...
|
9.9 Critical | — | 1,2% | 15 Sep 2026 |
|
CVE-2026-58502
githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpol...
|
7.1 High | — | 0,53% | 15 Sep 2026 |
|
CVE-2026-58485
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read receives its...
|
7.1 High | — | 0,19% | 15 Sep 2026 |
|
CVE-2026-58483
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read in src/index...
|
7.5 High | — | 0,67% | 15 Sep 2026 |
|
CVE-2026-57442
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored...
|
6.9 Medium | — | 0,19% | 15 Sep 2026 |
|
CVE-2026-57441
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricte...
|
8.4 High | — | 0,20% | 15 Sep 2026 |
|
CVE-2026-56831
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them...
|
6.5 Medium | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-56830
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products...
|
6.5 Medium | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-56829
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_...
|
8.1 High | — | 0,50% | 15 Sep 2026 |
|
CVE-2026-56827
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pa...
|
8.1 High | — | 0,50% | 15 Sep 2026 |
|
CVE-2026-56825
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and...
|
8.1 High | — | 0,50% | 15 Sep 2026 |
|
CVE-2026-55375
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token,...
|
5.3 Medium | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-55374
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::getPathVaria...
|
4.8 Medium | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-55226
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the To...
|
5.4 Medium | — | 0,25% | 15 Sep 2026 |
|
CVE-2026-55225
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can c...
|
8.0 High | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-54689
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL poli...
|
6.3 Medium | — | 0,19% | 15 Sep 2026 |