Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-89087
The cstruct package before 6.3.0 for OCaml mishandles indexes.
|
7.3 High | — | 0,32% | 10 Sep 2026 |
|
CVE-2026-89011
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prot...
|
7.1 High | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-89054
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines...
|
8.2 High | — | 0,51% | 10 Sep 2026 |
|
CVE-2026-88061
career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and...
|
5.8 Medium | — | 0,38% | 10 Sep 2026 |
|
CVE-2026-88062
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agen...
|
9.5 Critical | — | 1,4% | 10 Sep 2026 |
|
CVE-2026-84432
Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller (concrete/controllers/dialog/board/custom_slot.php) saveTemp...
|
5.3 Medium | — | 0,24% | 10 Sep 2026 |
|
CVE-2026-88060
angular
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4,...
|
6.1 Medium | — | 0,36% | 10 Sep 2026 |
|
CVE-2026-89049
A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Sy...
|
9.9 Critical | — | 0,66% | 10 Sep 2026 |
|
CVE-2026-9336
ibm websphere application server
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A re...
|
7.5 High | — | 0,77% | 10 Sep 2026 |
|
CVE-2026-9338
ibm websphere application server
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vu...
|
5.3 Medium | — | 0,49% | 10 Sep 2026 |
|
CVE-2026-88036
mongodb c driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to...
|
8.3 High | — | 0,27% | 10 Sep 2026 |
|
CVE-2026-88056
angular
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4,...
|
9.1 Critical | — | 0,54% | 10 Sep 2026 |
|
CVE-2026-88057
angular
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0,...
|
6.1 Medium | — | 0,37% | 10 Sep 2026 |
|
CVE-2026-88058
angular
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4,...
|
6.1 Medium | — | 0,28% | 10 Sep 2026 |
|
CVE-2026-88059
angular
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1,...
|
5.8 Medium | — | 0,34% | 10 Sep 2026 |
|
CVE-2026-88032
mongodb java driver
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation...
|
7.5 High | — | 0,26% | 10 Sep 2026 |
|
CVE-2026-88033
mongodb java driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier...
|
8.3 High | — | 0,46% | 10 Sep 2026 |
|
CVE-2026-88034
mongodb c++ driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier t...
|
8.3 High | — | 0,46% | 10 Sep 2026 |
|
CVE-2026-88035
mongodb c driver
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of...
|
5.5 Medium | — | 0,10% | 10 Sep 2026 |
|
CVE-2026-87993
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error mes...
|
7.7 High | — | 0,38% | 10 Sep 2026 |
|
CVE-2026-88021
Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to...
|
7.1 High | — | 0,34% | 10 Sep 2026 |
|
CVE-2026-87090
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's ca...
|
8.3 High | — | 0,37% | 10 Sep 2026 |
|
CVE-2026-87106
Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL a...
|
6.5 Medium | — | 0,41% | 10 Sep 2026 |
|
CVE-2026-87107
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog...
|
5.4 Medium | — | 0,31% | 10 Sep 2026 |
|
CVE-2026-68527
Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The di...
|
5.9 Medium | — | 0,47% | 10 Sep 2026 |
|
CVE-2026-89043
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookup...
|
7.4 High | — | 0,31% | 10 Sep 2026 |
|
CVE-2026-89044
netty
Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding head...
|
6.5 Medium | — | 0,28% | 10 Sep 2026 |
|
CVE-2026-89045
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops....
|
4.0 Medium | — | 0,18% | 10 Sep 2026 |
|
CVE-2026-89046
zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments....
|
8.2 High | — | 0,65% | 10 Sep 2026 |
|
CVE-2026-89042
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting...
|
9.1 Critical | — | 0,39% | 10 Sep 2026 |
|
CVE-2026-88051
tesseract-ocr tesseract ocr
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 f...
|
7.8 High | — | 0,17% | 10 Sep 2026 |
|
CVE-2026-88052
tesseract-ocr tesseract ocr
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop...
|
7.8 High | — | 0,18% | 10 Sep 2026 |
|
CVE-2026-88053
tesseract-ocr tesseract ocr
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumPr...
|
7.8 High | — | 0,18% | 10 Sep 2026 |
|
CVE-2026-88054
tesseract-ocr tesseract ocr
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts...
|
5.5 Medium | — | 0,15% | 10 Sep 2026 |
|
CVE-2026-88055
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can st...
|
5.5 Medium | — | 0,28% | 10 Sep 2026 |
|
CVE-2026-88027
laravel mongodb
Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-suppl...
|
8.1 High | — | 0,27% | 10 Sep 2026 |
|
CVE-2026-88028
laravel mongodb
Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied re...
|
6.5 Medium | — | 0,42% | 10 Sep 2026 |
|
CVE-2026-88029
mongodb python driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifie...
|
8.3 High | — | 0,27% | 10 Sep 2026 |
|
CVE-2026-88030
mongodb ruby driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier...
|
8.3 High | — | 0,27% | 10 Sep 2026 |
|
CVE-2026-88031
mongodb go driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to...
|
8.1 High | — | 0,48% | 10 Sep 2026 |
|
CVE-2026-88022
laravel mongodb
Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be in...
|
7.7 High | — | 0,43% | 10 Sep 2026 |
|
CVE-2026-88023
mongodb php library
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier...
|
8.3 High | — | 0,33% | 10 Sep 2026 |
|
CVE-2026-88024
mongodb rust driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier...
|
8.3 High | — | 0,48% | 10 Sep 2026 |
|
CVE-2026-88025
mongodb c# driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to...
|
8.3 High | — | 0,48% | 10 Sep 2026 |
|
CVE-2026-88026
mongodb c# driver
Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequen...
|
6.5 Medium | — | 0,38% | 10 Sep 2026 |
|
CVE-2026-68006
An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file
|
9.1 Critical | — | 0,53% | 10 Sep 2026 |
|
CVE-2026-15417
In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash.
|
6.9 Medium | — | 0,13% | 10 Sep 2026 |
|
CVE-2026-15418
In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of...
|
2.4 Low | — | 0,15% | 10 Sep 2026 |
|
CVE-2026-15419
In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memo...
|
7.0 High | — | 0,17% | 10 Sep 2026 |
|
CVE-2026-88049
tesseract-ocr tesseract ocr
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Ra...
|
5.5 Medium | — | 0,15% | 10 Sep 2026 |