Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-54077
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not...
|
7.1 High | — | 0,45% | 15 Sep 2026 |
|
CVE-2026-54076
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the...
|
8.1 High | — | 0,50% | 15 Sep 2026 |
|
CVE-2026-50024
GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .g...
|
5.3 Medium | — | 0,45% | 15 Sep 2026 |
|
CVE-2026-47215
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in...
|
4.8 Medium | — | 0,16% | 15 Sep 2026 |
|
CVE-2026-44282
Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store...
|
4.8 Medium | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-44163
fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentelemetry HTTP input read the enti...
|
5.3 Medium | — | 0,42% | 15 Sep 2026 |
|
CVE-2026-37152
TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.
|
9.8 Critical | — | 0,51% | 15 Sep 2026 |
|
CVE-2026-19407
Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and t...
|
7.7 High | — | 0,52% | 15 Sep 2026 |
|
CVE-2024-58384
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Atta...
|
5.4 Medium | — | 0,25% | 15 Sep 2026 |
|
CVE-2024-14029
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent reques...
|
7.5 High | — | 0,36% | 15 Sep 2026 |
|
CVE-2023-54397
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can s...
|
7.5 High | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-92082
By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server...
|
6.3 Medium | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-91842
A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/R...
|
4.1 Medium | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-91836
A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. Th...
|
2.8 Low | — | 0,33% | 15 Sep 2026 |
|
CVE-2026-91835
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the comp...
|
2.8 Low | — | 0,16% | 15 Sep 2026 |
|
CVE-2026-90650
The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and includin...
|
7.2 High | — | 0,40% | 15 Sep 2026 |
|
CVE-2026-90439
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurati...
|
6.5 Medium | — | 0,26% | 15 Sep 2026 |
|
CVE-2026-89025
Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTP(S) content. A remote unau...
|
7.5 High | — | 0,77% | 15 Sep 2026 |
|
CVE-2026-88618
1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code...
|
6.5 Medium | — | 0,34% | 15 Sep 2026 |
|
CVE-2026-88617
SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges.
|
9.8 Critical | — | 0,61% | 15 Sep 2026 |
|
CVE-2026-88616
An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, Com...
|
8.8 High | — | 0,69% | 15 Sep 2026 |
|
CVE-2026-79551
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
|
7.5 High | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-79425
An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafte...
|
8.1 High | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-79303
kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using para...
|
9.9 Critical | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-63696
Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote acce...
|
9.1 Critical | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-63695
Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation vulnerability. An unauthenticated attacker with remote access could potentially ex...
|
9.8 Critical | — | 0,50% | 15 Sep 2026 |
|
CVE-2026-61549
Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kuber...
|
9.0 Critical | — | 0,28% | 15 Sep 2026 |
|
CVE-2026-59971
MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_s...
|
10.0 Critical | — | 0,42% | 15 Sep 2026 |
|
CVE-2026-57586
CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code_rag/entry/cli.py...
|
8.6 High | — | 0,21% | 15 Sep 2026 |
|
CVE-2026-55650
Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/char...
|
4.4 Medium | — | 0,19% | 15 Sep 2026 |
|
CVE-2026-55617
Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts cr...
|
6.9 Medium | — | 0,47% | 15 Sep 2026 |
|
CVE-2026-55178
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize on...
|
7.5 High | — | 0,65% | 15 Sep 2026 |
|
CVE-2026-55158
Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and...
|
9.1 Critical | — | 0,80% | 15 Sep 2026 |
|
CVE-2026-54637
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts a...
|
5.5 Medium | — | 0,80% | 15 Sep 2026 |
|
CVE-2026-54254
Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring...
|
5.9 Medium | — | 0,53% | 15 Sep 2026 |
|
CVE-2026-54168
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App install...
|
6.5 Medium | — | 0,59% | 15 Sep 2026 |
|
CVE-2026-54167
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provi...
|
8.2 High | — | 0,27% | 15 Sep 2026 |
|
CVE-2026-53966
XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page...
|
7.1 High | — | 0,77% | 15 Sep 2026 |
|
CVE-2026-53957
Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export...
|
7.7 High | — | 0,42% | 15 Sep 2026 |
|
CVE-2026-52724
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mod...
|
5.8 Medium | — | 0,35% | 15 Sep 2026 |
|
CVE-2026-50166
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl pro...
|
5.5 Medium | — | 0,27% | 15 Sep 2026 |
|
CVE-2026-49446
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddlewar...
|
6.1 Medium | — | 0,30% | 15 Sep 2026 |
|
CVE-2026-49254
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v...
|
2.9 Low | — | 0,48% | 15 Sep 2026 |
|
CVE-2026-48987
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client o...
|
6.5 Medium | — | 0,44% | 15 Sep 2026 |
|
CVE-2026-48737
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's g...
|
4.9 Medium | — | 0,29% | 15 Sep 2026 |
|
CVE-2026-48722
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $...
|
5.5 Medium | — | 0,14% | 15 Sep 2026 |
|
CVE-2026-47780
free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/...
|
6.9 Medium | — | 0,54% | 15 Sep 2026 |
|
CVE-2026-46495
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector....
|
9.2 Critical | — | 1,1% | 15 Sep 2026 |
|
CVE-2026-39919
Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memor...
|
9.8 Critical | — | 0,78% | 15 Sep 2026 |
|
CVE-2026-25827
An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an ad...
|
2.3 Low | — | 0,16% | 15 Sep 2026 |