Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-88261
Improper input validation vulnerability in bizwell xClick allows Stored XSS.
This issue affects xClick: R2, R3, and R3.1.
|
5.1 Medium | — | 0,38% | 15 Sep 2026 |
|
CVE-2026-91774
Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply...
|
4.3 Medium | — | 0,34% | 15 Sep 2026 |
|
CVE-2026-91773
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they canno...
|
4.3 Medium | — | 0,34% | 15 Sep 2026 |
|
CVE-2026-91772
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malici...
|
6.1 Medium | — | 0,32% | 15 Sep 2026 |
|
CVE-2026-91771
Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers contr...
|
8.8 High | — | 1,2% | 15 Sep 2026 |
|
CVE-2026-91770
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attac...
|
6.5 Medium | — | 0,45% | 15 Sep 2026 |
|
CVE-2026-90851
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argume...
|
6.3 Medium | — | 0,37% | 15 Sep 2026 |
|
CVE-2026-90850
A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The...
|
2.4 Low | — | 0,37% | 15 Sep 2026 |
|
CVE-2026-90849
A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of th...
|
7.3 High | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-90848
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation...
|
4.3 Medium | — | 0,45% | 15 Sep 2026 |
|
CVE-2026-91752
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attack...
|
7.5 High | — | 0,74% | 15 Sep 2026 |
|
CVE-2026-91751
Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite f...
|
8.3 High | — | 0,54% | 15 Sep 2026 |
|
CVE-2026-91750
WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-suppli...
|
6.5 Medium | — | 0,44% | 15 Sep 2026 |
|
CVE-2026-90847
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipula...
|
9.1 Critical | — | 3,4% | 15 Sep 2026 |
|
CVE-2026-90846
A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of...
|
7.3 High | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-90845
A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manip...
|
3.5 Low | — | 0,35% | 15 Sep 2026 |
|
CVE-2026-90844
A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. P...
|
7.3 High | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-90843
A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of the file fun...
|
8.3 High | — | 2,2% | 15 Sep 2026 |
|
CVE-2026-85657
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘p...
|
5.4 Medium | — | 0,24% | 15 Sep 2026 |
|
CVE-2026-85575
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored C...
|
6.4 Medium | — | 0,26% | 15 Sep 2026 |
|
CVE-2026-90842
A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/...
|
3.7 Low | — | 0,31% | 15 Sep 2026 |
|
CVE-2026-90841
A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/c...
|
7.3 High | — | 0,43% | 15 Sep 2026 |
|
CVE-2026-90840
A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin/Dashboard....
|
7.3 High | — | 0,69% | 15 Sep 2026 |
|
CVE-2026-91201
DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can ob...
|
5.4 Medium | — | 0,21% | 14 Sep 2026 |
|
CVE-2026-91200
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar...
|
8.8 High | — | 0,65% | 14 Sep 2026 |
|
CVE-2026-91199
Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the sch...
|
5.0 Medium | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-91198
GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoint...
|
5.3 Medium | — | 0,42% | 14 Sep 2026 |
|
CVE-2026-91197
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external en...
|
6.5 Medium | — | 0,46% | 14 Sep 2026 |
|
CVE-2026-90835
A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content R...
|
3.5 Low | — | 0,35% | 14 Sep 2026 |
|
CVE-2026-90831
gnu binutils
A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the file bfd/elf-strtab.c of the component ELF String Ta...
|
5.3 Medium | — | 0,17% | 14 Sep 2026 |
|
CVE-2026-90830
gnu binutils
A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge...
|
5.3 Medium | — | 0,17% | 14 Sep 2026 |
|
CVE-2026-90829
gnu binutils
A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section H...
|
5.3 Medium | — | 0,17% | 14 Sep 2026 |
|
CVE-2026-81900
concretecms concrete cms
Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integ...
|
6.1 Medium | — | 0,26% | 14 Sep 2026 |
|
CVE-2026-77191
An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to s...
|
2.6 Low | — | 0,22% | 14 Sep 2026 |
|
CVE-2026-75945
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.
|
2.6 Low | — | 0,20% | 14 Sep 2026 |
|
CVE-2026-75944
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may...
|
2.6 Low | — | 0,22% | 14 Sep 2026 |
|
CVE-2026-75943
A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplica...
|
2.6 Low | — | 0,20% | 14 Sep 2026 |
|
CVE-2026-18116
concretecms concrete cms
Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications s...
|
6.1 Medium | — | 0,15% | 14 Sep 2026 |
|
CVE-2026-14986
The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data in...
|
6.8 Medium | — | 0,18% | 14 Sep 2026 |
|
CVE-2026-91181
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint...
|
6.5 Medium | — | 0,39% | 14 Sep 2026 |
|
CVE-2026-91146
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links....
|
6.1 Medium | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-91145
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject...
|
7.1 High | — | 0,42% | 14 Sep 2026 |
|
CVE-2026-91144
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbi...
|
7.5 High | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-91143
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attack...
|
7.2 High | — | 0,47% | 14 Sep 2026 |
|
CVE-2026-90828
gnu binutils
A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible of the file ld/ldelf.c of the component ELF Orphan...
|
6.6 Medium | — | 0,19% | 14 Sep 2026 |
|
CVE-2026-90827
A vulnerability was identified in GPAC 26.07.0. This affects the function gf_node_deactivate_ex of the file scenegraph/base_scenegraph.c of the component MP4Box. Such man...
|
3.3 Low | — | 0,17% | 14 Sep 2026 |
|
CVE-2026-90826
A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP4Box. This...
|
2.8 Low | — | 0,16% | 14 Sep 2026 |
|
CVE-2026-90825
A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4...
|
3.3 Low | — | 0,17% | 14 Sep 2026 |
|
CVE-2026-76081
ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the s...
|
5.5 Medium | — | 0,40% | 14 Sep 2026 |
|
CVE-2026-73449
On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacke...
|
5.9 Medium | — | 0,24% | 14 Sep 2026 |