Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-88016
rclone
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a sou...
|
7.1 High | — | 0,19% | 10 Sep 2026 |
|
CVE-2026-88017
rclone
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/s...
|
7.3 High | — | 0,23% | 10 Sep 2026 |
|
CVE-2026-88018
rclone
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-prox...
|
9.8 Critical | — | 0,51% | 10 Sep 2026 |
|
CVE-2026-87912
A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the pri...
|
5.9 Medium | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-87913
A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of...
|
5.9 Medium | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-88009
traefik
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaqu...
|
8.2 High | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-88011
traefik
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.U...
|
8.1 High | — | 0,42% | 10 Sep 2026 |
|
CVE-2026-81467
dell thinos
Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An...
|
9.8 Critical | — | 3,0% | 10 Sep 2026 |
|
CVE-2026-81468
dell thinos
Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A h...
|
7.2 High | — | 2,0% | 10 Sep 2026 |
|
CVE-2026-81046
dell thinos
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exp...
|
9.4 Critical | — | 0,55% | 10 Sep 2026 |
|
CVE-2026-81048
dell thinos
Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthent...
|
8.8 High | — | 2,4% | 10 Sep 2026 |
|
CVE-2026-81049
dell thinos
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentiall...
|
6.7 Medium | — | 0,12% | 10 Sep 2026 |
|
CVE-2026-81051
dell thinos
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Number Mutable to Older Versions vulnerability. A low privileged attacker with physical access...
|
6.6 Medium | — | 0,20% | 10 Sep 2026 |
|
CVE-2026-81052
dell thinos
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could p...
|
6.8 Medium | — | 0,18% | 10 Sep 2026 |
|
CVE-2026-79987
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.
|
8.8 High | — | 0,65% | 10 Sep 2026 |
|
CVE-2026-4129
There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and...
|
8.1 High | — | 0,35% | 10 Sep 2026 |
|
CVE-2026-4130
There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive in...
|
7.1 High | — | 0,11% | 10 Sep 2026 |
|
CVE-2026-88898
AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish co...
|
6.5 Medium | — | 0,39% | 10 Sep 2026 |
|
CVE-2026-88924
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-followin...
|
7.0 High | — | 0,18% | 10 Sep 2026 |
|
CVE-2026-88897
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, pro...
|
5.9 Medium | — | 0,56% | 10 Sep 2026 |
|
CVE-2026-88007
traefik
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransport...
|
9.1 Critical | — | 0,60% | 10 Sep 2026 |
|
CVE-2026-88008
traefik
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upg...
|
9.1 Critical | — | 0,49% | 10 Sep 2026 |
|
CVE-2026-88005
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session...
|
6.5 Medium | — | 0,37% | 10 Sep 2026 |
|
CVE-2026-88006
openwebui open webui
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session...
|
6.5 Medium | — | 0,37% | 10 Sep 2026 |
|
CVE-2026-88004
traefik
Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and...
|
7.4 High | — | 0,45% | 10 Sep 2026 |
|
CVE-2026-84821
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.
|
7.5 High | — | 0,39% | 10 Sep 2026 |
|
CVE-2026-85310
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
|
6.5 Medium | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-84816
Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.
|
7.1 High | — | 0,25% | 10 Sep 2026 |
|
CVE-2026-84819
Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.
|
7.1 High | — | 0,25% | 10 Sep 2026 |
|
CVE-2026-81796
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Tr...
|
7.3 High | — | 0,40% | 10 Sep 2026 |
|
CVE-2026-81799
Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions.
|
7.5 High | — | 0,35% | 10 Sep 2026 |
|
CVE-2026-81800
Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.
|
9.3 Critical | — | 0,40% | 10 Sep 2026 |
|
CVE-2026-81801
Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.
|
8.1 High | — | 0,38% | 10 Sep 2026 |
|
CVE-2026-81803
Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.
|
7.5 High | — | 0,58% | 10 Sep 2026 |
|
CVE-2026-81804
Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions.
|
7.5 High | — | 0,42% | 10 Sep 2026 |
|
CVE-2026-81805
Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.
|
8.1 High | — | 0,37% | 10 Sep 2026 |
|
CVE-2026-81791
Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.
|
6.5 Medium | — | 0,22% | 10 Sep 2026 |
|
CVE-2026-81793
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.Th...
|
6.5 Medium | — | 0,33% | 10 Sep 2026 |
|
CVE-2026-81794
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.
|
7.5 High | — | 0,35% | 10 Sep 2026 |
|
CVE-2026-81795
Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.
|
7.1 High | — | 0,25% | 10 Sep 2026 |
|
CVE-2026-81786
Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions.
|
7.5 High | — | 0,39% | 10 Sep 2026 |
|
CVE-2026-81787
Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.
|
6.5 Medium | — | 0,42% | 10 Sep 2026 |
|
CVE-2026-81788
Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.
|
6.3 Medium | — | 0,26% | 10 Sep 2026 |
|
CVE-2026-81789
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path...
|
8.6 High | — | 0,53% | 10 Sep 2026 |
|
CVE-2026-81782
Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.
|
6.5 Medium | — | 0,22% | 10 Sep 2026 |
|
CVE-2026-81783
Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.
|
7.1 High | — | 0,40% | 10 Sep 2026 |
|
CVE-2026-81784
Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2.
|
8.1 High | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-81785
Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.
|
6.5 Medium | — | 0,33% | 10 Sep 2026 |
|
CVE-2026-81275
Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.
|
6.5 Medium | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-78536
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.
|
6.5 Medium | — | 0,33% | 10 Sep 2026 |