Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-57125
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled...
|
9.8 Critical | — | 0,60% | 14 Sep 2026 |
|
CVE-2026-57123
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages...
|
9.8 Critical | — | 0,90% | 14 Sep 2026 |
|
CVE-2026-57120
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime assembly of blocklisted dunder names and allows str.fo...
|
6.5 Medium | — | 0,56% | 14 Sep 2026 |
|
CVE-2026-57115
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redi...
|
6.5 Medium | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-25687
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash...
|
8.1 High | — | 0,38% | 14 Sep 2026 |
|
CVE-2026-15600
Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the PO...
|
8.6 High | — | 0,24% | 14 Sep 2026 |
|
CVE-2026-12985
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component (matchin...
|
9.3 Critical | — | 0,27% | 14 Sep 2026 |
|
CVE-2026-90961
The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPAuthenticate replace CakePHP's...
|
9.3 Critical | — | 0,64% | 14 Sep 2026 |
|
CVE-2026-90949
A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch betw...
|
7.8 High | — | 0,33% | 14 Sep 2026 |
|
CVE-2026-90948
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the requ...
|
7.8 High | — | 0,23% | 14 Sep 2026 |
|
CVE-2026-90941
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export compl...
|
4.3 Medium | — | 0,41% | 14 Sep 2026 |
|
CVE-2026-90940
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate...
|
5.3 Medium | — | 0,55% | 14 Sep 2026 |
|
CVE-2026-90939
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers...
|
6.5 Medium | — | 0,46% | 14 Sep 2026 |
|
CVE-2026-90788
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/templa...
|
4.7 Medium | — | 2,2% | 14 Sep 2026 |
|
CVE-2026-90787
A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file co...
|
7.3 High | — | 0,54% | 14 Sep 2026 |
|
CVE-2026-90786
A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the file src/compiler/semantics.c of the component Duplic...
|
5.3 Medium | — | 0,72% | 14 Sep 2026 |
|
CVE-2026-90785
A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struct Analysis....
|
5.3 Medium | — | 0,72% | 14 Sep 2026 |
|
CVE-2026-86349
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which all...
|
4.3 Medium | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-86348
mattermost server
Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action r...
|
4.3 Medium | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-84179
Description
getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_...
|
6.5 Medium | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-82920
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allow...
|
5.5 Medium | — | 0,26% | 14 Sep 2026 |
|
CVE-2026-82441
Description
A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`,
which the client fills in after uploading the corresp...
|
9.1 Critical | — | 0,27% | 14 Sep 2026 |
|
CVE-2026-82439
Description
The DRPC server kept a map from function name to request queue and created an entry the first time a
function name was seen. No code path ever removed an ent...
|
9.8 Critical | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-7208
Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnosti...
|
5.3 Medium | — | 0,35% | 14 Sep 2026 |
|
CVE-2026-73370
Incorrect Authorization vulnerability in Apache Syncope.
Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete...
|
9.8 Critical | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-73236
Incorrect Authorization vulnerability in Apache Syncope.
Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches.
Due to...
|
7.5 High | — | 0,36% | 14 Sep 2026 |
|
CVE-2026-73195
Improper Encoding or Escaping of Output vulnerability in Apache Syncope.
Authenticated users can store a spreadsheet formula payload in one of their own plain attribut...
|
7.3 High | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-73191
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope.
When the Syncope SRA is configured for CAS authentication, the target Apereo CAS...
|
6.1 Medium | — | 0,31% | 14 Sep 2026 |
|
CVE-2026-90957
Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.
The commit explains that SVG files are XML documents rather than passi...
|
5.1 Medium | — | 0,40% | 14 Sep 2026 |
|
CVE-2026-90955
Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.
The shell is designed to run...
|
4.6 Medium | — | 0,16% | 14 Sep 2026 |
|
CVE-2026-90938
LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_...
|
8.6 High | — | 0,57% | 14 Sep 2026 |
|
CVE-2026-90937
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configu...
|
9.9 Critical | — | 0,45% | 14 Sep 2026 |
|
CVE-2026-90936
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias...
|
4.3 Medium | — | 0,31% | 14 Sep 2026 |
|
CVE-2026-90935
Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a...
|
4.3 Medium | — | 0,30% | 14 Sep 2026 |
|
CVE-2026-90934
EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted...
|
4.3 Medium | — | 0,31% | 14 Sep 2026 |
|
CVE-2026-90933
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and d...
|
7.1 High | — | 0,30% | 14 Sep 2026 |
|
CVE-2026-90932
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. Backu...
|
7.2 High | — | 0,82% | 14 Sep 2026 |
|
CVE-2026-90931
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to up...
|
5.4 Medium | — | 0,24% | 14 Sep 2026 |
|
CVE-2026-90930
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated u...
|
6.8 Medium | — | 0,50% | 14 Sep 2026 |
|
CVE-2026-90929
File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the...
|
8.1 High | — | 0,44% | 14 Sep 2026 |
|
CVE-2026-90928
File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limi...
|
6.5 Medium | — | 0,44% | 14 Sep 2026 |
|
CVE-2026-90927
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrar...
|
6.5 Medium | — | 0,44% | 14 Sep 2026 |
|
CVE-2026-90784
A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The manipulatio...
|
5.3 Medium | — | 0,72% | 14 Sep 2026 |
|
CVE-2026-90716
A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the compo...
|
5.5 Medium | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-90715
A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp...
|
7.3 High | — | 0,64% | 14 Sep 2026 |
|
CVE-2026-90714
A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON...
|
6.3 Medium | — | 0,47% | 14 Sep 2026 |
|
CVE-2026-90713
A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/h...
|
3.3 Low | — | 0,16% | 14 Sep 2026 |
|
CVE-2026-78336
Insertion of sensitive information into sent data vulnerability in Apache Syncope.
Any authenticated user can query for the list of available OIDC providers configured...
|
7.5 High | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-78330
Incorrect privilege assignment vulnerability in Apache Syncope.
When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and ke...
|
9.8 Critical | — | 0,64% | 14 Sep 2026 |
|
CVE-2026-78318
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.
The notification message, as optionally shown by...
|
6.1 Medium | — | 0,26% | 14 Sep 2026 |