Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-59973
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 unti...
|
8.5 High | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-59965
Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and...
|
7.1 High | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-59157
webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd a...
|
6.5 Medium | — | 0,60% | 15 Sep 2026 |
|
CVE-2026-58196
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth...
|
4.7 Medium | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-55887
MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker...
|
8.7 High | — | 0,22% | 15 Sep 2026 |
|
CVE-2026-55864
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server UR...
|
7.8 High | — | 0,59% | 15 Sep 2026 |
|
CVE-2026-55828
qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account...
|
6.0 Medium | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-55776
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate th...
|
6.5 Medium | — | 0,61% | 15 Sep 2026 |
|
CVE-2026-55775
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace...
|
2.3 Low | — | 0,48% | 15 Sep 2026 |
|
CVE-2026-55774
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revo...
|
2.1 Low | — | 0,56% | 15 Sep 2026 |
|
CVE-2026-55770
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where...
|
6.8 Medium | — | 0,53% | 15 Sep 2026 |
|
CVE-2026-55701
The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubrece...
|
6.9 Medium | — | 0,70% | 15 Sep 2026 |
|
CVE-2026-55636
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webh...
|
5.7 Medium | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-55591
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled hos...
|
5.8 Medium | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-55211
Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer overflow whe...
|
9.8 Critical | — | 0,74% | 15 Sep 2026 |
|
CVE-2026-54724
Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated a...
|
6.1 Medium | — | 0,35% | 15 Sep 2026 |
|
CVE-2026-54450
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networkin...
|
2.9 Low | — | 0,33% | 15 Sep 2026 |
|
CVE-2026-54077
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not...
|
7.1 High | — | 0,45% | 15 Sep 2026 |
|
CVE-2026-54076
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the...
|
8.1 High | — | 0,50% | 15 Sep 2026 |
|
CVE-2026-50024
GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .g...
|
5.3 Medium | — | 0,45% | 15 Sep 2026 |
|
CVE-2026-47215
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in...
|
4.8 Medium | — | 0,16% | 15 Sep 2026 |
|
CVE-2026-44282
Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store...
|
4.8 Medium | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-44163
fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentelemetry HTTP input read the enti...
|
5.3 Medium | — | 0,42% | 15 Sep 2026 |
|
CVE-2026-37152
TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.
|
9.8 Critical | — | 0,51% | 15 Sep 2026 |
|
CVE-2026-19407
Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and t...
|
7.7 High | — | 0,52% | 15 Sep 2026 |
|
CVE-2024-58384
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Atta...
|
5.4 Medium | — | 0,25% | 15 Sep 2026 |
|
CVE-2024-14029
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent reques...
|
7.5 High | — | 0,36% | 15 Sep 2026 |
|
CVE-2023-54397
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can s...
|
7.5 High | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-92082
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server...
|
6.3 Medium | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-91842
A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/R...
|
4.1 Medium | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-91836
A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. Th...
|
2.8 Low | — | 0,33% | 15 Sep 2026 |
|
CVE-2026-91835
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the comp...
|
2.8 Low | — | 0,16% | 15 Sep 2026 |
|
CVE-2026-90650
The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and includin...
|
7.2 High | — | 0,40% | 15 Sep 2026 |
|
CVE-2026-90439
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurati...
|
6.5 Medium | — | 0,26% | 15 Sep 2026 |
|
CVE-2026-89025
Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTP(S) content. A remote unau...
|
7.5 High | — | 0,77% | 15 Sep 2026 |
|
CVE-2026-88618
1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code...
|
6.5 Medium | — | 0,34% | 15 Sep 2026 |
|
CVE-2026-88617
SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges.
|
9.8 Critical | — | 0,61% | 15 Sep 2026 |
|
CVE-2026-88616
An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, Com...
|
8.8 High | — | 0,69% | 15 Sep 2026 |
|
CVE-2026-79551
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
|
7.5 High | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-79425
An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafte...
|
8.1 High | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-79303
kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using para...
|
9.9 Critical | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-63696
Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote acce...
|
9.1 Critical | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-63695
Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation vulnerability. An unauthenticated attacker with remote access could potentially ex...
|
9.8 Critical | — | 0,50% | 15 Sep 2026 |
|
CVE-2026-61549
Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kuber...
|
9.0 Critical | — | 0,28% | 15 Sep 2026 |
|
CVE-2026-59971
MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_s...
|
10.0 Critical | — | 0,42% | 15 Sep 2026 |
|
CVE-2026-57586
CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code_rag/entry/cli.py...
|
8.6 High | — | 0,21% | 15 Sep 2026 |
|
CVE-2026-55650
Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/char...
|
4.4 Medium | — | 0,19% | 15 Sep 2026 |
|
CVE-2026-55617
Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts cr...
|
6.9 Medium | — | 0,47% | 15 Sep 2026 |
|
CVE-2026-55178
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize on...
|
7.5 High | — | 0,65% | 15 Sep 2026 |
|
CVE-2026-55158
Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and...
|
9.1 Critical | — | 0,80% | 15 Sep 2026 |