Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-90943
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject ma...
|
8.7 High | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-90795
A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of...
|
4.3 Medium | — | 0,47% | 14 Sep 2026 |
|
CVE-2026-90794
A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component MP4Box. Perf...
|
6.3 Medium | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-90793
A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such ma...
|
5.4 Medium | — | 0,58% | 14 Sep 2026 |
|
CVE-2026-90792
A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. Thi...
|
4.3 Medium | — | 0,69% | 14 Sep 2026 |
|
CVE-2026-90463
A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS r...
|
4.0 Medium | — | 0,15% | 14 Sep 2026 |
|
CVE-2026-88819
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
|
6.3 Medium | — | 0,17% | 14 Sep 2026 |
|
CVE-2026-81301
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions.
The provider ma...
|
8.5 High | — | 0,16% | 14 Sep 2026 |
|
CVE-2026-61534
Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relation...
|
9.1 Critical | — | 0,84% | 14 Sep 2026 |
|
CVE-2026-57145
PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for rea...
|
9.1 Critical | — | 0,54% | 14 Sep 2026 |
|
CVE-2026-57132
PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without...
|
8.2 High | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-57131
PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentic...
|
9.8 Critical | — | 0,97% | 14 Sep 2026 |
|
CVE-2026-57127
PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authenti...
|
9.8 Critical | — | 0,90% | 14 Sep 2026 |
|
CVE-2026-57124
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller...
|
9.8 Critical | — | 1,0% | 14 Sep 2026 |
|
CVE-2026-57122
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBH...
|
8.6 High | — | 0,19% | 14 Sep 2026 |
|
CVE-2026-57119
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes i...
|
7.5 High | — | 0,53% | 14 Sep 2026 |
|
CVE-2026-56839
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and a...
|
7.3 High | — | 0,38% | 14 Sep 2026 |
|
CVE-2026-55795
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter o...
|
6.9 Medium | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-55236
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a...
|
5.9 Medium | — | 0,26% | 14 Sep 2026 |
|
CVE-2026-55235
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target th...
|
5.9 Medium | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-54542
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a sy...
|
3.7 Low | — | 0,44% | 14 Sep 2026 |
|
CVE-2026-54541
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a sy...
|
3.7 Low | — | 0,44% | 14 Sep 2026 |
|
CVE-2026-54529
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view...
|
5.3 Medium | — | 0,38% | 14 Sep 2026 |
|
CVE-2026-53708
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, th...
|
6.6 Medium | — | 0,35% | 14 Sep 2026 |
|
CVE-2026-47701
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.p...
|
7.7 High | — | 0,46% | 14 Sep 2026 |
|
CVE-2026-4103
Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This ena...
|
6.4 Medium | — | 0,30% | 14 Sep 2026 |
|
CVE-2025-24890
gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted...
|
6.8 Medium | — | 0,19% | 14 Sep 2026 |
|
CVE-2026-90791
A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component...
|
6.3 Medium | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-90790
A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_pu...
|
6.3 Medium | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-90789
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manip...
|
7.3 High | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-82438
Description
Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP
components served to an authenticated user.
The Logv...
|
8.1 High | — | 0,21% | 14 Sep 2026 |
|
CVE-2026-82437
Description
The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For
daemon logs those settings were not applied: the a...
|
4.3 Medium | — | 0,28% | 14 Sep 2026 |
|
CVE-2026-82435
Description
The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline
and acts on frames before any authentication has ta...
|
9.8 Critical | — | 0,65% | 14 Sep 2026 |
|
CVE-2026-82434
Description
When ZooKeeper authentication is configured, Storm deliberately retains
`storm.zookeeper.topology.auth.payload` in the topology configuration, because worker...
|
6.5 Medium | — | 0,50% | 14 Sep 2026 |
|
CVE-2026-82433
Description
`getNimbusConf` returned the complete daemon configuration without redaction after only a user-level
authorization check. Where the cluster is configured wit...
|
6.5 Medium | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-82432
Description
Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance
operation accepts configuration overrides and st...
|
8.1 High | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-82431
Description
`SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty,
before `nimbus.groups` was considered. An operat...
|
9.8 Critical | — | 0,39% | 14 Sep 2026 |
|
CVE-2026-82430
Description
When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the
entire worker directory to the untrusted topology use...
|
7.8 High | — | 0,14% | 14 Sep 2026 |
|
CVE-2026-82429
Description
The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking
the tree with FTS and calling `lchown` and `chmod...
|
7.8 High | — | 0,13% | 14 Sep 2026 |
|
CVE-2026-82428
Description
Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from
the Maven coordinate, for example `dep---.jar`. The...
|
8.8 High | — | 0,69% | 14 Sep 2026 |
|
CVE-2026-82427
Description
A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the
supervisor localises. That name was used to build a path...
|
7.8 High | — | 0,15% | 14 Sep 2026 |
|
CVE-2026-82426
Description
Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a
server-side path and opened it directly, without check...
|
6.5 Medium | — | 0,42% | 14 Sep 2026 |
|
CVE-2026-82019
TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary Java...
|
4.2 Medium | — | 0,29% | 14 Sep 2026 |
|
CVE-2026-7848
Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBe...
|
8.6 High | — | 0,38% | 14 Sep 2026 |
|
CVE-2026-59570
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.
|
7.5 High | — | 0,13% | 14 Sep 2026 |
|
CVE-2026-59569
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.
|
8.1 High | — | 0,18% | 14 Sep 2026 |
|
CVE-2026-57130
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr,...
|
8.1 High | — | 0,46% | 14 Sep 2026 |
|
CVE-2026-57129
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-r...
|
7.5 High | — | 0,53% | 14 Sep 2026 |
|
CVE-2026-57128
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerC...
|
4.3 Medium | — | 0,25% | 14 Sep 2026 |
|
CVE-2026-57126
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does n...
|
8.5 High | — | 0,38% | 14 Sep 2026 |