Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-90508
A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in the librar...
|
3.4 Low | — | 0,16% | 13 Sep 2026 |
|
CVE-2026-90504
A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulatio...
|
7.3 High | — | 0,65% | 13 Sep 2026 |
|
CVE-2026-90503
A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a man...
|
2.3 Low | — | 0,16% | 13 Sep 2026 |
|
CVE-2026-90502
A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Perfor...
|
3.5 Low | — | 0,33% | 13 Sep 2026 |
|
CVE-2026-90501
A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulatio...
|
6.3 Medium | — | 0,35% | 13 Sep 2026 |
|
CVE-2026-90500
A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upl...
|
6.3 Medium | — | 0,35% | 13 Sep 2026 |
|
CVE-2026-90498
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of defau...
|
7.3 High | — | 0,47% | 13 Sep 2026 |
|
CVE-2026-90499
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update...
|
5.4 Medium | — | 0,38% | 13 Sep 2026 |
|
CVE-2026-90496
A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file application/c...
|
4.7 Medium | — | 0,33% | 13 Sep 2026 |
|
CVE-2026-90497
A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/add_...
|
3.5 Low | — | 0,33% | 13 Sep 2026 |
|
CVE-2026-88764
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for...
|
5.4 Medium | — | 0,23% | 13 Sep 2026 |
|
CVE-2026-88912
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attache...
|
4.2 Medium | — | 0,19% | 13 Sep 2026 |
|
CVE-2026-88995
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauth...
|
5.3 Medium | — | 0,35% | 13 Sep 2026 |
|
CVE-2026-89080
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, al...
|
7.5 High | — | 0,34% | 13 Sep 2026 |
|
CVE-2026-86406
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the paymen...
|
7.5 High | — | 0,32% | 13 Sep 2026 |
|
CVE-2026-86407
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in t...
|
3.7 Low | — | 0,28% | 13 Sep 2026 |
|
CVE-2026-80072
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated...
|
4.7 Medium | — | 0,29% | 13 Sep 2026 |
|
CVE-2026-80071
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to thei...
|
7.2 High | — | 0,46% | 13 Sep 2026 |
|
CVE-2026-77773
The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX a...
|
5.3 Medium | — | 0,35% | 13 Sep 2026 |
|
CVE-2026-90678
An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support...
|
7.5 High | — | 0,77% | 13 Sep 2026 |
|
CVE-2026-90679
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or cont...
|
4.3 Medium | — | 0,18% | 13 Sep 2026 |
|
CVE-2026-90494
A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path tra...
|
5.3 Medium | — | 0,77% | 13 Sep 2026 |
|
CVE-2026-90495
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWeb...
|
7.3 High | — | 0,41% | 13 Sep 2026 |
|
CVE-2026-90493
A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the...
|
8.8 High | — | 0,16% | 13 Sep 2026 |
|
CVE-2026-90668
The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service...
|
7.5 High | — | 0,58% | 13 Sep 2026 |
|
CVE-2026-90492
A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. The affected element is the function controller_listen/controller_recover of the file py...
|
6.3 Medium | — | 2,4% | 13 Sep 2026 |
|
CVE-2026-90491
A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Exe...
|
6.3 Medium | — | 0,42% | 13 Sep 2026 |
|
CVE-2026-90490
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results...
|
6.3 Medium | — | 0,41% | 13 Sep 2026 |
|
CVE-2026-90648
wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check t...
|
7.1 High | — | 0,19% | 13 Sep 2026 |
|
CVE-2026-90651
Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstr...
|
8.1 High | — | 0,21% | 13 Sep 2026 |
|
CVE-2026-90488
A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/c...
|
6.3 Medium | — | 0,39% | 13 Sep 2026 |
|
CVE-2026-90489
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name...
|
3.5 Low | — | 0,33% | 13 Sep 2026 |
|
CVE-2026-90486
A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of th...
|
6.3 Medium | — | 0,40% | 12 Sep 2026 |
|
CVE-2026-90487
A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/b...
|
4.3 Medium | — | 0,35% | 12 Sep 2026 |
|
CVE-2026-90647
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (...
|
7.4 High | — | 0,21% | 12 Sep 2026 |
|
CVE-2026-79300
SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capab...
|
3.5 Low | — | 0,26% | 12 Sep 2026 |
|
CVE-2026-90485
A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub_11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Ha...
|
5.5 Medium | — | 0,17% | 12 Sep 2026 |
|
CVE-2026-90616
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on...
|
7.4 High | — | 0,18% | 12 Sep 2026 |
|
CVE-2026-90556
Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bo...
|
7.8 High | — | 0,20% | 12 Sep 2026 |
|
CVE-2026-90557
Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indice...
|
6.1 Medium | — | 0,18% | 12 Sep 2026 |
|
CVE-2026-90558
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers ca...
|
9.8 Critical | — | 0,88% | 12 Sep 2026 |
|
CVE-2026-90559
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never valid...
|
7.5 High | — | 0,63% | 12 Sep 2026 |
|
CVE-2026-90560
zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never v...
|
8.2 High | — | 0,62% | 12 Sep 2026 |
|
CVE-2026-90554
vllm
vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nano_nemotron...
|
7.5 High | — | 0,20% | 12 Sep 2026 |
|
CVE-2026-90555
vllm
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers...
|
6.5 Medium | — | 0,52% | 12 Sep 2026 |
|
CVE-2026-90547
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing una...
|
5.3 Medium | — | 0,41% | 12 Sep 2026 |
|
CVE-2026-90548
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticate...
|
5.3 Medium | — | 0,40% | 12 Sep 2026 |
|
CVE-2026-90549
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated gu...
|
5.3 Medium | — | 0,34% | 12 Sep 2026 |
|
CVE-2026-90550
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning v...
|
5.3 Medium | — | 0,41% | 12 Sep 2026 |
|
CVE-2026-90551
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the video_from_program API endpoint, allowing unauthenticated...
|
5.3 Medium | — | 0,40% | 12 Sep 2026 |