Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-89261
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or...
|
6.5 Medium | — | 0,83% | 11 Sep 2026 |
|
CVE-2026-89262
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of...
|
7.5 High | — | 0,54% | 11 Sep 2026 |
|
CVE-2026-89065
Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and...
|
7.1 High | — | 0,19% | 11 Sep 2026 |
|
CVE-2026-89066
Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to exec...
|
7.8 High | — | 0,23% | 11 Sep 2026 |
|
CVE-2026-89012
Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover...
|
6.5 Medium | — | 0,46% | 11 Sep 2026 |
|
CVE-2026-89013
Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage en...
|
7.5 High | — | 1,6% | 11 Sep 2026 |
|
CVE-2026-81861
CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality.
|
5.9 Medium | — | 0,54% | 11 Sep 2026 |
|
CVE-2026-7863
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus...
|
8.4 High | — | 0,95% | 11 Sep 2026 |
|
CVE-2026-70341
microsoft edge, microsoft edge chromium
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
|
8.8 High | — | 0,55% | 11 Sep 2026 |
|
CVE-2026-68497
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFacto...
|
7.5 High | — | 0,58% | 11 Sep 2026 |
|
CVE-2026-3869
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provid...
|
9.2 Critical | — | 0,54% | 11 Sep 2026 |
|
CVE-2026-15439
The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipr...
|
6.5 Medium | — | 0,23% | 11 Sep 2026 |
|
CVE-2026-8301
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus...
|
7.8 High | — | 0,84% | 11 Sep 2026 |
|
CVE-2026-8303
Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software allows Privilege Escalation.
This issue affects P...
|
7.8 High | — | 0,14% | 11 Sep 2026 |
|
CVE-2026-89009
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to...
|
9.1 Critical | — | 1,0% | 11 Sep 2026 |
|
CVE-2026-89010
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to...
|
9.8 Critical | — | 3,2% | 11 Sep 2026 |
|
CVE-2026-87983
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allo...
|
9.2 Critical | — | 0,62% | 11 Sep 2026 |
|
CVE-2026-87984
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without u...
|
9.3 Critical | — | 0,50% | 11 Sep 2026 |
|
CVE-2026-87985
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not pr...
|
10.0 Critical | — | 0,56% | 11 Sep 2026 |
|
CVE-2026-87986
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unpa...
|
10.0 Critical | — | 0,56% | 11 Sep 2026 |
|
CVE-2026-87987
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlis...
|
10.0 Critical | — | 0,56% | 11 Sep 2026 |
|
CVE-2026-87988
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing...
|
10.0 Critical | — | 0,43% | 11 Sep 2026 |
|
CVE-2026-85083
The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to g...
|
6.8 Medium | — | 0,29% | 11 Sep 2026 |
|
CVE-2026-85979
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell c...
|
8.6 High | — | 1,3% | 11 Sep 2026 |
|
CVE-2026-87020
An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.
|
8.1 High | — | 0,56% | 11 Sep 2026 |
|
CVE-2026-82578
When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE i...
|
7.5 High | — | 0,41% | 11 Sep 2026 |
|
CVE-2026-82583
NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in di...
|
8.3 High | — | 0,45% | 11 Sep 2026 |
|
CVE-2026-78224
The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service att...
|
8.2 High | — | 0,44% | 11 Sep 2026 |
|
CVE-2026-38056
A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across o...
|
8.8 High | — | 0,15% | 11 Sep 2026 |
|
CVE-2026-38058
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes...
|
8.1 High | — | 0,46% | 11 Sep 2026 |
|
CVE-2026-89298
A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the vie...
|
4.9 Medium | — | 0,41% | 11 Sep 2026 |
|
CVE-2026-89212
A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affe...
|
8.6 High | — | 0,44% | 11 Sep 2026 |
|
CVE-2026-71416
Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of i...
|
8.8 High | — | 0,17% | 11 Sep 2026 |
|
CVE-2026-71641
An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via thenteracti...
|
7.5 High | — | 0,61% | 11 Sep 2026 |
|
CVE-2026-71644
An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potentia...
|
9.8 Critical | — | 0,65% | 11 Sep 2026 |
|
CVE-2026-57843
NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by o...
|
5.5 Medium | — | 0,15% | 11 Sep 2026 |
|
CVE-2026-57842
NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement befor...
|
7.0 High | — | 0,14% | 11 Sep 2026 |
|
CVE-2026-15710
An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication c...
|
6.8 Medium | — | 0,10% | 11 Sep 2026 |
|
CVE-2026-11765
Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen all...
|
3.3 Low | — | 0,12% | 11 Sep 2026 |
|
CVE-2026-84390
A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow a...
|
9.8 Critical | — | 0,52% | 11 Sep 2026 |
|
CVE-2026-80462
A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functi...
|
10.0 Critical | — | 2,0% | 11 Sep 2026 |
|
CVE-2026-89256
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not enc...
|
8.7 High | — | 0,37% | 11 Sep 2026 |
|
CVE-2026-89257
AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::...
|
5.4 Medium | — | 0,30% | 11 Sep 2026 |
|
CVE-2026-89258
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing...
|
6.3 Medium | — | 0,47% | 11 Sep 2026 |
|
CVE-2026-89259
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list...
|
9.8 Critical | — | 0,59% | 11 Sep 2026 |
|
CVE-2026-89250
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams r...
|
7.5 High | — | 0,50% | 11 Sep 2026 |
|
CVE-2026-89251
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit arbitrary...
|
6.5 Medium | — | 0,18% | 11 Sep 2026 |
|
CVE-2026-89252
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modif...
|
6.5 Medium | — | 0,31% | 11 Sep 2026 |
|
CVE-2026-89253
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::s...
|
8.7 High | — | 0,37% | 11 Sep 2026 |
|
CVE-2026-89254
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field_name param...
|
8.7 High | — | 0,37% | 11 Sep 2026 |