Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-55244
ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and Gen...
|
5.0 Medium | — | 0,18% | 14 Sep 2026 |
|
CVE-2026-55209
resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimen...
|
9.8 Critical | — | 0,78% | 14 Sep 2026 |
|
CVE-2026-55093
Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication i...
|
6.1 Medium | — | 0,18% | 14 Sep 2026 |
|
CVE-2026-54632
SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddres...
|
7.5 High | — | 0,72% | 14 Sep 2026 |
|
CVE-2026-54629
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader...
|
7.5 High | — | 0,97% | 14 Sep 2026 |
|
CVE-2026-54628
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reade...
|
8.6 High | — | 0,60% | 14 Sep 2026 |
|
CVE-2026-54559
PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngram_model_trie.c do not adequately validate boundary conditions in...
|
6.9 Medium | — | 0,55% | 14 Sep 2026 |
|
CVE-2026-54447
garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates t...
|
8.4 High | — | 0,15% | 14 Sep 2026 |
|
CVE-2026-54334
UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compressio...
|
9.8 Critical | — | 0,80% | 14 Sep 2026 |
|
CVE-2026-54333
UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compressi...
|
9.8 Critical | — | 0,80% | 14 Sep 2026 |
|
CVE-2026-54247
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of request...
|
4.3 Medium | — | 0,30% | 14 Sep 2026 |
|
CVE-2026-54246
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-l...
|
5.7 Medium | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-53717
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefet...
|
6.5 Medium | — | 0,72% | 14 Sep 2026 |
|
CVE-2026-50006
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite witho...
|
9.1 Critical | — | 0,97% | 14 Sep 2026 |
|
CVE-2026-47253
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the call...
|
7.3 High | — | 0,44% | 14 Sep 2026 |
|
CVE-2026-19816
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove...
|
7.1 High | — | 0,11% | 14 Sep 2026 |
|
CVE-2026-19624
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipse...
|
7.8 High | — | 0,13% | 14 Sep 2026 |
|
CVE-2026-18251
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.
|
4.3 Medium | — | 0,14% | 14 Sep 2026 |
|
CVE-2026-18119
concretecms concrete cms
Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site sc...
|
9.0 Critical | — | 0,31% | 14 Sep 2026 |
|
CVE-2026-18065
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.
|
5.3 Medium | — | 0,31% | 14 Sep 2026 |
|
CVE-2026-17628
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.
|
5.4 Medium | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-17467
IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic prot...
|
8.2 High | — | 0,21% | 14 Sep 2026 |
|
CVE-2026-17463
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a...
|
6.5 Medium | — | 0,35% | 14 Sep 2026 |
|
CVE-2026-17416
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserializati...
|
7.8 High | — | 0,14% | 14 Sep 2026 |
|
CVE-2026-17156
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserializati...
|
7.8 High | — | 0,14% | 14 Sep 2026 |
|
CVE-2026-17133
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralizatio...
|
7.8 High | — | 0,15% | 14 Sep 2026 |
|
CVE-2026-17047
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.
|
5.4 Medium | — | 0,12% | 14 Sep 2026 |
|
CVE-2026-16702
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a...
|
6.5 Medium | — | 0,35% | 14 Sep 2026 |
|
CVE-2026-16673
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of s...
|
8.8 High | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-16466
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection.
|
8.8 High | — | 0,93% | 14 Sep 2026 |
|
CVE-2026-16435
IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features.
|
5.9 Medium | — | 0,31% | 14 Sep 2026 |
|
CVE-2026-16432
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML ex...
|
6.5 Medium | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-16428
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT...
|
8.8 High | — | 0,55% | 14 Sep 2026 |
|
CVE-2026-16338
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of fil...
|
8.8 High | — | 0,44% | 14 Sep 2026 |
|
CVE-2026-16335
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vu...
|
8.8 High | — | 0,46% | 14 Sep 2026 |
|
CVE-2026-16190
IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability.
|
3.1 Low | — | 0,16% | 14 Sep 2026 |
|
CVE-2026-16189
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.
|
4.8 Medium | — | 0,22% | 14 Sep 2026 |
|
CVE-2026-16188
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.
|
5.3 Medium | — | 0,27% | 14 Sep 2026 |
|
CVE-2026-16187
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated...
|
6.5 Medium | — | 0,25% | 14 Sep 2026 |
|
CVE-2026-16186
IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability.
|
5.4 Medium | — | 0,18% | 14 Sep 2026 |
|
CVE-2026-16185
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet.
|
6.4 Medium | — | 0,20% | 14 Sep 2026 |
|
CVE-2026-16148
The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) inside it82xx...
|
4.6 Medium | — | 0,17% | 14 Sep 2026 |
|
CVE-2026-16147
The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_out() the act...
|
6.8 Medium | — | 0,18% | 14 Sep 2026 |
|
CVE-2026-15955
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.
|
7.5 High | — | 0,40% | 14 Sep 2026 |
|
CVE-2026-15924
Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared by every TLS...
|
5.9 Medium | — | 0,31% | 14 Sep 2026 |
|
CVE-2026-15887
IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests.
|
5.4 Medium | — | 0,18% | 14 Sep 2026 |
|
CVE-2026-15634
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the H...
|
6.5 Medium | — | 0,25% | 14 Sep 2026 |
|
CVE-2026-15412
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redi...
|
6.5 Medium | — | 0,23% | 14 Sep 2026 |
|
CVE-2026-15396
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the H...
|
6.5 Medium | — | 0,25% | 14 Sep 2026 |
|
CVE-2026-90812
A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permiss...
|
4.3 Medium | — | 0,39% | 14 Sep 2026 |