Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2022-42917
In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config...
|
6.7 Medium | — | 0,13% | 14 Sep 2026 |
|
CVE-2024-53922
An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial of Service...
|
5.7 Medium | — | 0,16% | 14 Sep 2026 |
|
CVE-2026-90600
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulation of the...
|
6.3 Medium | — | 0,33% | 13 Sep 2026 |
|
CVE-2026-90601
A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_service/main.py of the component REST API. The manipul...
|
7.3 High | — | 0,69% | 13 Sep 2026 |
|
CVE-2026-90602
A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio....
|
3.5 Low | — | 0,36% | 13 Sep 2026 |
|
CVE-2026-90603
A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary o...
|
7.3 High | — | 0,50% | 13 Sep 2026 |
|
CVE-2026-15892
The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/sett...
|
5.3 Medium | — | 0,27% | 13 Sep 2026 |
|
CVE-2026-15891
The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLI...
|
7.5 High | — | 0,34% | 13 Sep 2026 |
|
CVE-2026-90599
A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/proces...
|
4.3 Medium | — | 0,24% | 13 Sep 2026 |
|
CVE-2026-90596
A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw.rs. This m...
|
6.5 Medium | — | 0,58% | 13 Sep 2026 |
|
CVE-2026-90597
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/sup_edit1.php. S...
|
6.3 Medium | — | 0,33% | 13 Sep 2026 |
|
CVE-2026-90598
A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserControl...
|
6.3 Medium | — | 0,39% | 13 Sep 2026 |
|
CVE-2026-52296
ffmpeg
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
|
7.1 High | — | 0,16% | 13 Sep 2026 |
|
CVE-2026-52297
ffmpeg
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.
|
7.1 High | — | 0,12% | 13 Sep 2026 |
|
CVE-2026-35867
A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacte...
|
3.1 Low | — | 1,0% | 13 Sep 2026 |
|
CVE-2026-90595
A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ac...
|
6.3 Medium | — | 0,37% | 13 Sep 2026 |
|
CVE-2026-90584
A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java...
|
5.3 Medium | — | 0,72% | 13 Sep 2026 |
|
CVE-2026-90593
A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipu...
|
7.3 High | — | 0,52% | 13 Sep 2026 |
|
CVE-2026-90594
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rp...
|
6.3 Medium | — | 0,37% | 13 Sep 2026 |
|
CVE-2026-85129
The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to i...
|
8.8 High | — | 0,48% | 13 Sep 2026 |
|
CVE-2026-88793
The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front...
|
8.8 High | — | 0,51% | 13 Sep 2026 |
|
CVE-2026-88802
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of...
|
7.5 High | — | 0,40% | 13 Sep 2026 |
|
CVE-2026-89050
The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling...
|
4.3 Medium | — | 0,15% | 13 Sep 2026 |
|
CVE-2026-74933
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printi...
|
8.8 High | — | 0,50% | 13 Sep 2026 |
|
CVE-2026-81648
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invok...
|
10.0 Critical | — | 0,50% | 13 Sep 2026 |
|
CVE-2026-36989
A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php.
|
5.8 Medium | — | 0,34% | 13 Sep 2026 |
|
CVE-2026-37008
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocki...
|
8.1 High | — | 0,16% | 13 Sep 2026 |
|
CVE-2026-38332
TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length.
|
2.9 Low | — | 0,16% | 13 Sep 2026 |
|
CVE-2026-36453
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.
|
7.4 High | — | 0,27% | 13 Sep 2026 |
|
CVE-2026-29811
CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM...
|
7.7 High | — | 0,34% | 13 Sep 2026 |
|
CVE-2026-29812
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.
|
4.3 Medium | — | 0,28% | 13 Sep 2026 |
|
CVE-2026-90580
flowiseai flowise
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/ind...
|
6.3 Medium | — | 0,41% | 13 Sep 2026 |
|
CVE-2026-90581
A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This m...
|
6.3 Medium | — | 0,41% | 13 Sep 2026 |
|
CVE-2026-90582
A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. Impacted is the function saveTodos of the file src/index.js of the component API Todo Endpoint. Su...
|
5.3 Medium | — | 0,70% | 13 Sep 2026 |
|
CVE-2026-90583
A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.p...
|
4.3 Medium | — | 0,49% | 13 Sep 2026 |
|
CVE-2026-29810
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.
|
4.3 Medium | — | 0,31% | 13 Sep 2026 |
|
CVE-2025-70820
Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.
|
3.5 Low | — | 0,18% | 13 Sep 2026 |
|
CVE-2026-90577
A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c of the comp...
|
5.3 Medium | — | 0,18% | 13 Sep 2026 |
|
CVE-2026-90578
A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gf_list_count of the file utils/list.c of the component MP4Box. Executing a manipulat...
|
5.3 Medium | — | 0,17% | 13 Sep 2026 |
|
CVE-2026-90579
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custom_auth_hand...
|
7.3 High | — | 0,65% | 13 Sep 2026 |
|
CVE-2026-90576
A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gf_node_list_add_child of the file scenegraph/base_scenegraph.c of the compone...
|
3.3 Low | — | 0,17% | 13 Sep 2026 |
|
CVE-2025-70819
Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/h_etc:rw in a...
|
6.3 Medium | — | 0,11% | 13 Sep 2026 |
|
CVE-2025-64059
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify temp...
|
1.8 Low | — | 0,30% | 13 Sep 2026 |
|
CVE-2025-45480
Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.
|
3.0 Low | — | 0,15% | 13 Sep 2026 |
|
CVE-2020-15875
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL inje...
|
5.0 Medium | — | 0,34% | 13 Sep 2026 |
|
CVE-2026-90575
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This...
|
3.7 Low | — | 0,48% | 13 Sep 2026 |
|
CVE-2026-90573
A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the component MP4Box. T...
|
3.3 Low | — | 0,17% | 13 Sep 2026 |
|
CVE-2026-90574
A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emp_transac.php?action=add. The ma...
|
6.3 Medium | — | 0,33% | 13 Sep 2026 |
|
CVE-2026-90572
A vulnerability was determined in davenardella snap7 up to 1.4.3. The affected element is the function TSnap7MicroClient::opUpload of the file src/core/s7_micro_client.cp...
|
4.7 Medium | — | 0,42% | 13 Sep 2026 |
|
CVE-2026-90571
A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WE...
|
4.3 Medium | — | 0,47% | 13 Sep 2026 |