Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-91949
freerdp
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite se...
|
9.3 Critical | — | 0,56% | 15 Sep 2026 |
|
CVE-2026-91948
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. A...
|
7.5 High | — | 0,59% | 15 Sep 2026 |
|
CVE-2026-91947
FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization...
|
7.5 High | — | 0,31% | 15 Sep 2026 |
|
CVE-2026-91946
freerdp
FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes...
|
6.5 Medium | — | 0,53% | 15 Sep 2026 |
|
CVE-2026-91945
freerdp
FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arr...
|
6.5 Medium | — | 0,58% | 15 Sep 2026 |
|
CVE-2026-91944
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent...
|
6.1 Medium | — | 0,26% | 15 Sep 2026 |
|
CVE-2026-91943
Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests w...
|
7.7 High | — | 0,35% | 15 Sep 2026 |
|
CVE-2026-91942
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attac...
|
5.4 Medium | — | 0,24% | 15 Sep 2026 |
|
CVE-2026-91941
Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service....
|
7.5 High | — | 0,49% | 15 Sep 2026 |
|
CVE-2026-91940
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted...
|
7.5 High | — | 0,46% | 15 Sep 2026 |
|
CVE-2026-91938
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection....
|
7.1 High | — | 0,37% | 15 Sep 2026 |
|
CVE-2026-91937
Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers...
|
7.5 High | — | 0,47% | 15 Sep 2026 |
|
CVE-2026-91936
Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell...
|
6.8 Medium | — | 0,46% | 15 Sep 2026 |
|
CVE-2026-91935
Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatfl...
|
8.3 High | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-91934
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write ar...
|
8.8 High | — | 0,74% | 15 Sep 2026 |
|
CVE-2026-91933
Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in ot...
|
7.1 High | — | 0,35% | 15 Sep 2026 |
|
CVE-2026-91932
Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated...
|
8.5 High | — | 0,73% | 15 Sep 2026 |
|
CVE-2026-91931
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx...
|
8.5 High | — | 0,68% | 15 Sep 2026 |
|
CVE-2026-91930
Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organiz...
|
7.5 High | — | 0,40% | 15 Sep 2026 |
|
CVE-2026-91929
Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Ent...
|
7.1 High | — | 0,35% | 15 Sep 2026 |
|
CVE-2026-91849
A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the compone...
|
6.3 Medium | — | 0,37% | 15 Sep 2026 |
|
CVE-2026-91848
A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getData...
|
7.3 High | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-89307
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling for...
|
5.1 Medium | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-88621
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a no...
|
2.7 Low | — | 0,31% | 15 Sep 2026 |
|
CVE-2026-88620
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the re...
|
4.3 Medium | — | 0,28% | 15 Sep 2026 |
|
CVE-2026-88619
1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job manag...
|
8.1 High | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-87793
The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file,
allowing an unauthenticated attacker to...
|
5.1 Medium | — | 0,51% | 15 Sep 2026 |
|
CVE-2026-87792
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing...
|
8.7 High | — | 0,46% | 15 Sep 2026 |
|
CVE-2026-87791
A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows...
|
8.7 High | — | 0,54% | 15 Sep 2026 |
|
CVE-2026-85013
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `...
|
7.3 High | — | 0,22% | 15 Sep 2026 |
|
CVE-2026-77972
Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that v...
|
9.0 Critical | — | 0,33% | 15 Sep 2026 |
|
CVE-2026-77866
Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is con...
|
9.0 Critical | — | 0,48% | 15 Sep 2026 |
|
CVE-2026-65831
ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, Poly...
|
7.7 High | — | 0,60% | 15 Sep 2026 |
|
CVE-2026-59973
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 unti...
|
8.5 High | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-59965
Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and...
|
7.1 High | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-59157
webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd a...
|
6.5 Medium | — | 0,60% | 15 Sep 2026 |
|
CVE-2026-58196
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth...
|
4.7 Medium | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-55887
MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker...
|
8.7 High | — | 0,22% | 15 Sep 2026 |
|
CVE-2026-55864
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server UR...
|
7.8 High | — | 0,59% | 15 Sep 2026 |
|
CVE-2026-55828
qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account...
|
6.0 Medium | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-55776
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate th...
|
6.5 Medium | — | 0,61% | 15 Sep 2026 |
|
CVE-2026-55775
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace...
|
2.3 Low | — | 0,48% | 15 Sep 2026 |
|
CVE-2026-55774
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace could revo...
|
2.1 Low | — | 0,56% | 15 Sep 2026 |
|
CVE-2026-55770
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where...
|
6.8 Medium | — | 0,53% | 15 Sep 2026 |
|
CVE-2026-55701
The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubrece...
|
6.9 Medium | — | 0,70% | 15 Sep 2026 |
|
CVE-2026-55636
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webh...
|
5.7 Medium | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-55591
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled hos...
|
5.8 Medium | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-55211
Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer overflow whe...
|
9.8 Critical | — | 0,74% | 15 Sep 2026 |
|
CVE-2026-54724
Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated a...
|
6.1 Medium | — | 0,35% | 15 Sep 2026 |
|
CVE-2026-54450
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networkin...
|
2.9 Low | — | 0,33% | 15 Sep 2026 |