Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-54688
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, web_url_read passes a cal...
|
6.5 Medium | — | 0,50% | 15 Sep 2026 |
|
CVE-2026-54549
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, the upload_ad_image tool in meta_ads_mcp/core/ads.py...
|
8.3 High | — | 0,40% | 15 Sep 2026 |
|
CVE-2026-54547
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in meta_ads_mcp/core/http_au...
|
7.4 High | — | 0,52% | 15 Sep 2026 |
|
CVE-2026-54251
netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in co...
|
8.7 High | — | 0,51% | 15 Sep 2026 |
|
CVE-2026-54050
Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authenticated user...
|
6.5 Medium | — | 0,31% | 15 Sep 2026 |
|
CVE-2026-53954
Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a va...
|
4.3 Medium | — | 0,56% | 15 Sep 2026 |
|
CVE-2026-53941
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.27.0 until 0.53.1, th...
|
6.9 Medium | — | 0,52% | 15 Sep 2026 |
|
CVE-2026-53459
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authen...
|
9.3 Critical | — | 0,76% | 15 Sep 2026 |
|
CVE-2026-52484
An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-inte...
|
8.8 High | — | 0,64% | 15 Sep 2026 |
|
CVE-2026-48785
Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive i...
|
4.8 Medium | — | 0,15% | 15 Sep 2026 |
|
CVE-2026-45579
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManage...
|
9.9 Critical | — | 0,86% | 15 Sep 2026 |
|
CVE-2026-44300
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network cl...
|
8.8 High | — | 0,75% | 15 Sep 2026 |
|
CVE-2026-40058
CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious...
|
8.8 High | — | 0,08% | 15 Sep 2026 |
|
CVE-2026-39040
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
|
5.4 Medium | — | 0,24% | 15 Sep 2026 |
|
CVE-2026-39039
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is f...
|
5.3 Medium | — | 0,37% | 15 Sep 2026 |
|
CVE-2026-39038
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.
|
6.1 Medium | — | 0,25% | 15 Sep 2026 |
|
CVE-2026-18115
Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/ap...
|
7.4 High | — | 0,26% | 15 Sep 2026 |
|
CVE-2026-18113
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or...
|
7.5 High | — | 0,29% | 15 Sep 2026 |
|
CVE-2026-13210
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions co...
|
7.7 High | — | 0,21% | 15 Sep 2026 |
|
CVE-2026-12910
gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions co...
|
5.4 Medium | — | 0,20% | 15 Sep 2026 |
|
CVE-2026-12752
IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker cou...
|
7.1 High | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-12751
ibm cloud pak for business automation
IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the vic...
|
5.4 Medium | — | 0,20% | 15 Sep 2026 |
|
CVE-2026-12750
ibm cloud pak for business automation
IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in...
|
5.4 Medium | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-12749
ibm cloud pak for business automation
IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in...
|
5.4 Medium | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-12742
IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization contro...
|
5.4 Medium | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-12728
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...
|
8.8 High | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-12667
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...
|
7.1 High | — | 0,27% | 15 Sep 2026 |
|
CVE-2026-12666
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...
|
8.1 High | — | 0,26% | 15 Sep 2026 |
|
CVE-2026-12358
IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.
|
7.5 High | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-12355
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...
|
8.1 High | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-12354
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...
|
7.5 High | — | 0,33% | 15 Sep 2026 |
|
CVE-2026-12351
IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to...
|
9.8 Critical | — | 0,48% | 15 Sep 2026 |
|
CVE-2026-12150
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...
|
7.0 High | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-12101
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
|
8.1 High | — | 0,27% | 15 Sep 2026 |
|
CVE-2026-11934
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.
|
7.2 High | — | 0,32% | 15 Sep 2026 |
|
CVE-2026-11929
IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.
|
7.5 High | — | 0,16% | 15 Sep 2026 |
|
CVE-2026-11928
IBM Verify Identity Access is vulnerable to a buffer overflow attack.
|
9.8 Critical | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-11927
IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services.
|
6.5 Medium | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-11926
IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.
|
7.5 High | — | 0,31% | 15 Sep 2026 |
|
CVE-2026-11921
IBM Verify Identity Access containers may not apply management password change operations correctly.
|
9.1 Critical | — | 0,23% | 15 Sep 2026 |
|
CVE-2026-11918
IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of n...
|
5.4 Medium | — | 0,16% | 15 Sep 2026 |
|
CVE-2026-11864
IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 thro...
|
6.5 Medium | — | 0,22% | 15 Sep 2026 |
|
CVE-2026-11729
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...
|
8.5 High | — | 0,31% | 15 Sep 2026 |
|
CVE-2026-11728
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through...
|
8.1 High | — | 0,35% | 15 Sep 2026 |
|
CVE-2025-66974
An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) or connectio...
|
7.5 High | — | 0,37% | 15 Sep 2026 |
|
CVE-2026-91855
A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/handler.c of the component PFC...
|
5.3 Medium | — | 0,72% | 15 Sep 2026 |
|
CVE-2026-91854
A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such manipulation of the argument...
|
4.3 Medium | — | 0,47% | 15 Sep 2026 |
|
CVE-2026-91853
A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOv...
|
7.4 High | — | 1,8% | 15 Sep 2026 |
|
CVE-2026-89026
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file t...
|
9.8 Critical | — | 0,69% | 15 Sep 2026 |
|
CVE-2026-89022
BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary...
|
7.4 High | — | 0,46% | 15 Sep 2026 |