Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-90811
A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury-agent/src/...
|
3.3 Low | — | 0,15% | 14 Sep 2026 |
|
CVE-2026-90810
A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13. The impacted element is the function PermissionManager.checkShellCommand of the file m...
|
6.3 Medium | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-90809
A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/...
|
7.3 High | — | 0,56% | 14 Sep 2026 |
|
CVE-2026-90808
A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of...
|
6.3 Medium | — | 0,41% | 14 Sep 2026 |
|
CVE-2026-89023
ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attack...
|
8.6 High | — | 0,39% | 14 Sep 2026 |
|
CVE-2026-89021
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the...
|
6.9 Medium | — | 0,38% | 14 Sep 2026 |
|
CVE-2026-89020
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that...
|
4.3 Medium | — | 0,49% | 14 Sep 2026 |
|
CVE-2026-86830
Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remot...
|
7.2 High | — | 0,69% | 14 Sep 2026 |
|
CVE-2026-82519
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass...
|
4.3 Medium | — | 0,36% | 14 Sep 2026 |
|
CVE-2026-82049
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archi...
|
8.4 High | — | 0,19% | 14 Sep 2026 |
|
CVE-2026-82035
PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output file...
|
7.1 High | — | 0,32% | 14 Sep 2026 |
|
CVE-2026-77884
Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files...
|
7.1 High | — | 0,25% | 14 Sep 2026 |
|
CVE-2026-59178
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from...
|
9.8 Critical | — | 0,78% | 14 Sep 2026 |
|
CVE-2026-19543
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to...
|
6.2 Medium | — | 0,12% | 14 Sep 2026 |
|
CVE-2026-18515
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator...
|
4.3 Medium | — | 0,28% | 14 Sep 2026 |
|
CVE-2026-18151
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process.
|
4.2 Medium | — | 0,14% | 14 Sep 2026 |
|
CVE-2026-15893
net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32_get() % (m...
|
6.5 Medium | — | 0,20% | 14 Sep 2026 |
|
CVE-2026-91081
Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing...
|
5.8 Medium | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-91080
webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized...
|
7.5 High | — | 0,66% | 14 Sep 2026 |
|
CVE-2026-91079
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated worksp...
|
8.5 High | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-91021
Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escap...
|
5.4 Medium | — | 0,23% | 14 Sep 2026 |
|
CVE-2026-90946
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesyste...
|
7.5 High | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-90945
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated att...
|
9.8 Critical | — | 0,77% | 14 Sep 2026 |
|
CVE-2026-90944
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into th...
|
8.2 High | — | 0,66% | 14 Sep 2026 |
|
CVE-2026-90942
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization admin...
|
9.6 Critical | — | 0,28% | 14 Sep 2026 |
|
CVE-2026-90807
A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of...
|
6.3 Medium | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-90806
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_views.py of t...
|
6.3 Medium | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-90805
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin...
|
7.3 High | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-86836
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agen...
|
8.4 High | — | 0,11% | 14 Sep 2026 |
|
CVE-2026-85921
microsoft windows 11 26h1
Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
|
8.2 High | — | 0,35% | 14 Sep 2026 |
|
CVE-2026-85892
microsoft edge chromium
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate pr...
|
7.8 High | — | 0,20% | 14 Sep 2026 |
|
CVE-2026-73494
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance la...
|
7.4 High | — | 0,63% | 14 Sep 2026 |
|
CVE-2026-70658
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle...
|
7.4 High | — | 0,58% | 14 Sep 2026 |
|
CVE-2026-57583
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11,...
|
3.3 Low | — | 0,19% | 14 Sep 2026 |
|
CVE-2026-57581
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow u...
|
5.3 Medium | — | 0,59% | 14 Sep 2026 |
|
CVE-2026-57578
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because...
|
9.2 Critical | — | 0,62% | 14 Sep 2026 |
|
CVE-2026-57577
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in...
|
8.2 High | — | 0,58% | 14 Sep 2026 |
|
CVE-2026-57570
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. F...
|
6.5 Medium | — | 0,44% | 14 Sep 2026 |
|
CVE-2026-55866
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIP...
|
3.7 Low | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-55847
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/hel...
|
6.1 Medium | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-55846
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses U...
|
6.2 Medium | — | 0,18% | 14 Sep 2026 |
|
CVE-2026-55832
Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-control...
|
6.1 Medium | — | 0,19% | 14 Sep 2026 |
|
CVE-2026-55253
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, M...
|
7.7 High | — | 0,53% | 14 Sep 2026 |
|
CVE-2026-55091
flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influe...
|
7.5 High | — | 0,50% | 14 Sep 2026 |
|
CVE-2026-54723
devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated m...
|
6.5 Medium | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-54567
Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lowercase_ext to...
|
7.5 High | — | 0,63% | 14 Sep 2026 |
|
CVE-2026-54182
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. P...
|
8.1 High | — | 0,78% | 14 Sep 2026 |
|
CVE-2026-54181
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. F...
|
5.4 Medium | — | 0,31% | 14 Sep 2026 |
|
CVE-2026-54180
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. F...
|
7.6 High | — | 0,46% | 14 Sep 2026 |
|
CVE-2026-54178
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. P...
|
8.1 High | — | 0,56% | 14 Sep 2026 |