Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-91846
Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referen...
|
7.1 High | — | 0,35% | 15 Sep 2026 |
|
CVE-2026-91826
Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector a...
|
4.4 Medium | — | 0,14% | 15 Sep 2026 |
|
CVE-2026-91825
Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.
The vulnerable logic checked whether the acting user could use a sh...
|
7.1 High | — | 0,39% | 15 Sep 2026 |
|
CVE-2026-91782
gnu binutils
A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the component...
|
3.3 Low | — | 0,18% | 15 Sep 2026 |
|
CVE-2026-91781
gnu binutils
A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of the component...
|
3.3 Low | — | 0,18% | 15 Sep 2026 |
|
CVE-2026-91780
gnu binutils
A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Executing a manipulation can lead to...
|
3.3 Low | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-91779
gnu binutils
A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of the file bfd/elf-eh-frame.c of the component Eh Fr...
|
3.3 Low | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-80217
Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbit...
|
8.7 High | — | 0,51% | 15 Sep 2026 |
|
CVE-2026-77853
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the produ...
|
8.7 High | — | 1,9% | 15 Sep 2026 |
|
CVE-2026-76159
Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacke...
|
7.0 High | — | 0,13% | 15 Sep 2026 |
|
CVE-2026-75092
A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs...
|
7.3 High | — | 0,13% | 15 Sep 2026 |
|
CVE-2026-91819
Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.
CakePHP honors a _method field...
|
6.9 Medium | — | 0,20% | 15 Sep 2026 |
|
CVE-2026-91778
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worke...
|
7.2 High | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-91091
A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph/base_scenegraph.c of the comp...
|
4.3 Medium | — | 0,69% | 15 Sep 2026 |
|
CVE-2026-91090
A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulatio...
|
3.9 Low | — | 0,17% | 15 Sep 2026 |
|
CVE-2026-91089
A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation results in u...
|
6.3 Medium | — | 0,51% | 15 Sep 2026 |
|
CVE-2026-91088
A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file utils/url.c of the component URL Handler. The man...
|
4.8 Medium | — | 0,16% | 15 Sep 2026 |
|
CVE-2026-91087
A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. E...
|
7.3 High | — | 0,64% | 15 Sep 2026 |
|
CVE-2026-91086
A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filters/reframe_mpgvid.c of the co...
|
6.3 Medium | — | 0,55% | 15 Sep 2026 |
|
CVE-2026-91005
A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_picture.php of t...
|
6.3 Medium | — | 0,37% | 15 Sep 2026 |
|
CVE-2026-90711
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 throu...
|
9.1 Critical | — | 0,33% | 15 Sep 2026 |
|
CVE-2026-89141
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including,...
|
6.5 Medium | — | 0,45% | 15 Sep 2026 |
|
CVE-2026-75983
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including...
|
7.5 High | — | 0,71% | 15 Sep 2026 |
|
CVE-2026-18063
The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter in all versions up to, and including, 2.8.1 due to...
|
6.4 Medium | — | 0,20% | 15 Sep 2026 |
|
CVE-2026-15402
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_object...
|
6.4 Medium | — | 0,25% | 15 Sep 2026 |
|
CVE-2026-91004
A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1.php. Such m...
|
7.3 High | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-91003
A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulation of the...
|
9.1 Critical | — | 0,98% | 15 Sep 2026 |
|
CVE-2026-91002
A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of the file core/httpd.py of the component Blacklist E...
|
5.3 Medium | — | 0,77% | 15 Sep 2026 |
|
CVE-2026-91001
A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a ma...
|
9.9 Critical | — | 0,93% | 15 Sep 2026 |
|
CVE-2026-86701
Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's...
|
1.8 Low | — | 0,14% | 15 Sep 2026 |
|
CVE-2026-81320
A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — includin...
|
5.5 Medium | — | 0,19% | 15 Sep 2026 |
|
CVE-2026-81303
A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the...
|
6.3 Medium | — | 0,49% | 15 Sep 2026 |
|
CVE-2026-18232
The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX action...
|
5.3 Medium | — | 0,21% | 15 Sep 2026 |
|
CVE-2026-17495
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object...
|
5.9 Medium | — | 0,36% | 15 Sep 2026 |
|
CVE-2026-16593
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users w...
|
6.8 Medium | — | 0,22% | 15 Sep 2026 |
|
CVE-2026-16592
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Cont...
|
2.7 Low | — | 0,18% | 15 Sep 2026 |
|
CVE-2026-15758
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an...
|
5.3 Medium | — | 0,27% | 15 Sep 2026 |
|
CVE-2026-90881
A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manip...
|
5.3 Medium | — | 0,83% | 15 Sep 2026 |
|
CVE-2026-90880
A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the componen...
|
7.4 High | — | 1,9% | 15 Sep 2026 |
|
CVE-2026-90879
A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Modul...
|
7.3 High | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-90878
A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering....
|
4.3 Medium | — | 0,53% | 15 Sep 2026 |
|
CVE-2026-90877
A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requirement_stat...
|
7.3 High | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-90876
A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_requi...
|
7.3 High | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-90858
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function sessi...
|
7.3 High | — | 0,52% | 15 Sep 2026 |
|
CVE-2026-90857
A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the...
|
6.3 Medium | — | 0,37% | 15 Sep 2026 |
|
CVE-2026-90856
A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.php of the c...
|
7.3 High | — | 0,50% | 15 Sep 2026 |
|
CVE-2026-90855
A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. This manipulat...
|
7.3 High | — | 0,41% | 15 Sep 2026 |
|
CVE-2026-90854
A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-...
|
7.3 High | — | 0,41% | 15 Sep 2026 |
|
CVE-2026-90852
A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the...
|
7.3 High | — | 0,54% | 15 Sep 2026 |
|
CVE-2026-88262
Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass.
This issue affects xClick: R2, R3, and R3.1.
|
8.7 High | — | 0,58% | 15 Sep 2026 |