Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-90894
Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer cred...
|
7.8 High | — | 0,17% | 14 Sep 2026 |
|
CVE-2026-90893
MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicit...
|
5.1 Medium | — | 0,26% | 14 Sep 2026 |
|
CVE-2026-90704
A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the a...
|
6.6 Medium | — | 2,3% | 14 Sep 2026 |
|
CVE-2026-90703
A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the ar...
|
9.1 Critical | — | 3,6% | 14 Sep 2026 |
|
CVE-2026-90702
A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os...
|
9.1 Critical | — | 3,6% | 14 Sep 2026 |
|
CVE-2026-90701
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown function o...
|
7.3 High | — | 0,43% | 14 Sep 2026 |
|
CVE-2026-72524
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to.
Thi...
|
8.8 High | — | 0,47% | 14 Sep 2026 |
|
CVE-2026-68570
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting i...
|
6.5 Medium | — | 0,38% | 14 Sep 2026 |
|
CVE-2026-90700
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. Such manipula...
|
6.3 Medium | — | 0,33% | 14 Sep 2026 |
|
CVE-2026-90699
A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argum...
|
9.9 Critical | — | 3,3% | 14 Sep 2026 |
|
CVE-2026-90698
A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the...
|
5.3 Medium | — | 0,86% | 14 Sep 2026 |
|
CVE-2026-90697
A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument I...
|
4.3 Medium | — | 0,41% | 14 Sep 2026 |
|
CVE-2026-90696
A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/products_handler.p...
|
3.5 Low | — | 0,35% | 14 Sep 2026 |
|
CVE-2026-89321
Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opened.
On t...
|
4.3 Medium | — | 0,44% | 14 Sep 2026 |
|
CVE-2026-88932
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file wr...
|
5.3 Medium | — | 0,53% | 14 Sep 2026 |
|
CVE-2026-90695
A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendors_handler.p...
|
3.5 Low | — | 0,35% | 14 Sep 2026 |
|
CVE-2026-90694
A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customers_handler.php of the component...
|
3.5 Low | — | 0,35% | 14 Sep 2026 |
|
CVE-2026-90693
A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Seconda...
|
9.9 Critical | — | 0,91% | 14 Sep 2026 |
|
CVE-2026-12518
A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM...
|
8.5 High | — | 0,11% | 14 Sep 2026 |
|
CVE-2026-90692
A vulnerability was detected in D-Link DIR-878 120B05. This affects the function SetDynamicDNSIPv6Settings of the component Dynamic DNS IPv6 Settings. The manipulation of...
|
9.9 Critical | — | 0,91% | 14 Sep 2026 |
|
CVE-2026-90691
A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManage...
|
8.3 High | — | 0,62% | 14 Sep 2026 |
|
CVE-2026-90690
A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hex...
|
7.3 High | — | 2,1% | 14 Sep 2026 |
|
CVE-2026-90689
A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argume...
|
8.8 High | — | 0,85% | 14 Sep 2026 |
|
CVE-2026-90688
A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulat...
|
6.5 Medium | — | 0,71% | 14 Sep 2026 |
|
CVE-2026-88853
Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supports JavaSc...
|
7.5 High | — | 0,42% | 14 Sep 2026 |
|
CVE-2026-88852
Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0 - Snip...
|
7.5 High | — | 0,42% | 14 Sep 2026 |
|
CVE-2026-85196
Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles Anywhere Pro...
|
5.3 Medium | — | 0,44% | 14 Sep 2026 |
|
CVE-2026-85195
Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 - Articles Anywhere accepts link options suc...
|
7.5 High | — | 0,42% | 14 Sep 2026 |
|
CVE-2026-85192
Advisory
Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0 - Conditional Content Pro accepts...
|
9.4 Critical | — | 0,67% | 14 Sep 2026 |
|
CVE-2026-85191
Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites links matc...
|
7.5 High | — | 0,42% | 14 Sep 2026 |
|
CVE-2026-85190
Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable class values in...
|
7.5 High | — | 0,42% | 14 Sep 2026 |
|
CVE-2026-85189
Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination using an execu...
|
7.5 High | — | 0,42% | 14 Sep 2026 |
|
CVE-2026-85188
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater...
|
6.9 Medium | — | 0,37% | 14 Sep 2026 |
|
CVE-2026-85125
The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause inf...
|
5.1 Medium | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-82796
SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an att...
|
5.4 Medium | — | 0,24% | 14 Sep 2026 |
|
CVE-2026-82795
SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS command ma...
|
5.4 Medium | — | 0,24% | 14 Sep 2026 |
|
CVE-2026-82794
SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by a...
|
8.8 High | — | 1,9% | 14 Sep 2026 |
|
CVE-2026-82793
Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded b...
|
7.2 High | — | 0,63% | 14 Sep 2026 |
|
CVE-2026-82792
Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary script may...
|
5.2 Medium | — | 0,24% | 14 Sep 2026 |
|
CVE-2026-82791
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit...
|
8.8 High | — | 1,9% | 14 Sep 2026 |
|
CVE-2026-82790
Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is exploited, an ar...
|
5.4 Medium | — | 0,24% | 14 Sep 2026 |
|
CVE-2026-82789
An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS). If exploited, arbitrary code may be e...
|
8.8 High | — | 0,55% | 14 Sep 2026 |
|
CVE-2026-82788
Cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
|
6.1 Medium | — | 0,26% | 14 Sep 2026 |
|
CVE-2026-82787
Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote atta...
|
9.8 Critical | — | 0,67% | 14 Sep 2026 |
|
CVE-2026-82786
Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. If this vulnerability is exploited, sensitive information may be...
|
6.3 Medium | — | 0,30% | 14 Sep 2026 |
|
CVE-2026-82785
Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. Receiving a specially crafted request created and sent by a remot...
|
4.3 Medium | — | 0,49% | 14 Sep 2026 |
|
CVE-2026-82784
Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. An attacker may execute a REST API without authe...
|
6.5 Medium | — | 0,34% | 14 Sep 2026 |
|
CVE-2026-82783
Plaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical access to the product may obtain cre...
|
4.2 Medium | — | 0,18% | 14 Sep 2026 |
|
CVE-2026-82782
Out-of-bounds write vulnerability exists in CONPROSYS nano Series. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-servi...
|
4.3 Medium | — | 0,46% | 14 Sep 2026 |
|
CVE-2026-82781
Cross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web brow...
|
5.4 Medium | — | 0,24% | 14 Sep 2026 |