Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-78299
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of t...
|
9.1 Critical | — | 0,54% | 14 Sep 2026 |
|
CVE-2026-77883
Exposure of sensitive information through data queries vulnerability in Apache Syncope.
An administrator with adequate entitlements for Derived Schemas can create a mali...
|
4.9 Medium | — | 0,39% | 14 Sep 2026 |
|
CVE-2026-77181
Incorrect Authorization vulnerability in Apache Syncope.
An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientA...
|
9.8 Critical | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-77147
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a m...
|
6.5 Medium | — | 0,45% | 14 Sep 2026 |
|
CVE-2026-77051
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.
An administrator with adequate entitlements can...
|
9.8 Critical | — | 0,60% | 14 Sep 2026 |
|
CVE-2026-75030
Missing Authorization vulnerability in Apache Syncope.
An administrator with task execution entitlements might be able to mass (de)provision group members, regardless...
|
9.8 Critical | — | 0,62% | 14 Sep 2026 |
|
CVE-2026-75015
Insufficiently Protected Credentials vulnerability in Apache Syncope.
Audit events, when sent to the configured store, are not sufficiently masked for the sensitive valu...
|
4.9 Medium | — | 0,39% | 14 Sep 2026 |
|
CVE-2026-73668
Incorrect Authorization vulnerability in Apache Syncope.
An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector...
|
9.8 Critical | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-73579
Incorrect Authorization vulnerability in Apache Syncope.
Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the ac...
|
9.8 Critical | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-73470
Improper Privilege Management vulnerability in Apache Syncope.
Delegations can be created or updated with Roles not owned by the delegating User, or not for the same...
|
9.8 Critical | — | 0,51% | 14 Sep 2026 |
|
CVE-2026-73178
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope.
An administrator with adequate entitlements can get access via REST to the li...
|
7.5 High | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-12258
Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email...
|
9.2 Critical | — | 0,40% | 14 Sep 2026 |
|
CVE-2024-58383
Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles...
|
7.3 High | — | 0,10% | 14 Sep 2026 |
|
CVE-2026-90919
LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first cli...
|
9.8 Critical | — | 1,1% | 14 Sep 2026 |
|
CVE-2026-90712
A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the compon...
|
4.3 Medium | — | 0,56% | 14 Sep 2026 |
|
CVE-2026-90710
A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/ThemeServic...
|
7.3 High | — | 0,50% | 14 Sep 2026 |
|
CVE-2026-90709
A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin...
|
4.7 Medium | — | 0,41% | 14 Sep 2026 |
|
CVE-2026-79701
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2...
|
6.9 Medium | — | 0,45% | 14 Sep 2026 |
|
CVE-2026-21391
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain c...
|
9.5 Critical | — | 0,45% | 14 Sep 2026 |
|
CVE-2026-9812
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before u...
|
6.5 Medium | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-90898
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added...
|
9.8 Critical | — | 2,3% | 14 Sep 2026 |
|
CVE-2026-90891
ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially craf...
|
5.5 Medium | — | 0,13% | 14 Sep 2026 |
|
CVE-2026-90890
ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send a speciall...
|
5.5 Medium | — | 0,14% | 14 Sep 2026 |
|
CVE-2026-90708
A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This m...
|
7.3 High | — | 0,41% | 14 Sep 2026 |
|
CVE-2026-90707
A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c of the com...
|
8.3 High | — | 0,53% | 14 Sep 2026 |
|
CVE-2026-90706
A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid lea...
|
6.6 Medium | — | 2,3% | 14 Sep 2026 |
|
CVE-2026-90705
A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executi...
|
6.6 Medium | — | 2,3% | 14 Sep 2026 |
|
CVE-2026-8821
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run cr...
|
7.1 High | — | 0,29% | 14 Sep 2026 |
|
CVE-2026-89180
EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read dat...
|
7.5 High | — | 0,56% | 14 Sep 2026 |
|
CVE-2026-87802
Improper verification of cryptographic signature vulnerability in Apache Syncope.
When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can f...
|
9.1 Critical | — | 0,28% | 14 Sep 2026 |
|
CVE-2026-87785
Authentication bypass by spoofing vulnerability in Apache Syncope.
When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol a...
|
9.1 Critical | — | 0,55% | 14 Sep 2026 |
|
CVE-2026-87779
Insertion of sensitive information into log file vulnerability in Apache Syncope.
When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will...
|
7.5 High | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-86460
Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0...
|
9.8 Critical | — | 0,60% | 14 Sep 2026 |
|
CVE-2026-82232
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.
An administrator with adequate entitlements can a...
|
9.8 Critical | — | 0,60% | 14 Sep 2026 |
|
CVE-2026-81566
Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invoked the com...
|
5.1 Medium | — | 0,39% | 14 Sep 2026 |
|
CVE-2026-81565
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request parameter replaced...
|
6.9 Medium | — | 0,47% | 14 Sep 2026 |
|
CVE-2026-81564
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The med...
|
7.0 High | — | 0,47% | 14 Sep 2026 |
|
CVE-2026-79700
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optin_form addo...
|
6.9 Medium | — | 0,45% | 14 Sep 2026 |
|
CVE-2026-78375
Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSppagebuilder...
|
8.6 High | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-5132
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allo...
|
6.5 Medium | — | 0,42% | 14 Sep 2026 |
|
CVE-2026-20773
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to ac...
|
8.5 High | — | 0,21% | 14 Sep 2026 |
|
CVE-2026-15814
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image fi...
|
6.5 Medium | — | 0,24% | 14 Sep 2026 |
|
CVE-2026-14344
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized a...
|
4.3 Medium | — | 0,15% | 14 Sep 2026 |
|
CVE-2026-14259
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files whic...
|
4.3 Medium | — | 0,15% | 14 Sep 2026 |
|
CVE-2026-13417
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation which all...
|
4.3 Medium | — | 0,22% | 14 Sep 2026 |
|
CVE-2026-12882
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses...
|
4.3 Medium | — | 0,22% | 14 Sep 2026 |
|
CVE-2026-11993
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and h...
|
4.3 Medium | — | 0,22% | 14 Sep 2026 |
|
CVE-2026-10556
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloa...
|
5.3 Medium | — | 0,25% | 14 Sep 2026 |
|
CVE-2026-10542
mattermost server
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel managers to u...
|
4.3 Medium | — | 0,12% | 14 Sep 2026 |
|
CVE-2026-90895
Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies....
|
8.4 High | — | 0,15% | 14 Sep 2026 |