Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-64838
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from...
|
8.3 High | — | 0,52% | 10 Sep 2026 |
|
CVE-2026-45763
oisf suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5...
|
5.9 Medium | — | 0,62% | 10 Sep 2026 |
|
CVE-2026-38626
Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php.
|
9.8 Critical | — | 0,47% | 10 Sep 2026 |
|
CVE-2026-12682
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored X...
|
5.4 Medium | — | 0,16% | 10 Sep 2026 |
|
CVE-2026-12683
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored X...
|
5.4 Medium | — | 0,16% | 10 Sep 2026 |
|
CVE-2026-88038
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value a...
|
4.8 Medium | — | 0,25% | 10 Sep 2026 |
|
CVE-2026-9161
Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting.
This issue affects Website Template: through 10092026. NOTE: Th...
|
5.3 Medium | — | 0,33% | 10 Sep 2026 |
|
CVE-2026-9163
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injec...
|
9.8 Critical | — | 0,47% | 10 Sep 2026 |
|
CVE-2026-9166
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal....
|
7.5 High | — | 0,50% | 10 Sep 2026 |
|
CVE-2026-85543
Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi config...
|
4.3 Medium | — | 0,27% | 10 Sep 2026 |
|
CVE-2026-85544
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main...
|
6.1 Medium | — | 0,41% | 10 Sep 2026 |
|
CVE-2026-85545
There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to acc...
|
7.1 High | — | 0,29% | 10 Sep 2026 |
|
CVE-2026-17038
DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket syste...
|
6.9 Medium | — | 0,26% | 10 Sep 2026 |
|
CVE-2026-84828
A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read...
|
6.5 Medium | — | 0,14% | 10 Sep 2026 |
|
CVE-2026-88859
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victi...
|
6.3 Medium | — | 0,53% | 10 Sep 2026 |
|
CVE-2026-87961
ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID...
|
7.1 High | — | 0,47% | 10 Sep 2026 |
|
CVE-2026-87962
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized d...
|
7.5 High | — | 0,63% | 10 Sep 2026 |
|
CVE-2026-78085
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked directory confineme...
|
6.9 Medium | — | 0,50% | 10 Sep 2026 |
|
CVE-2026-78083
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 - The visitor booking (properti...
|
7.1 High | — | 0,21% | 10 Sep 2026 |
|
CVE-2026-78084
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorizat...
|
6.9 Medium | — | 0,33% | 10 Sep 2026 |
|
CVE-2026-78302
Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4 - Multiple temp...
|
8.6 High | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-78303
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on...
|
6.9 Medium | — | 0,43% | 10 Sep 2026 |
|
CVE-2026-78374
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action ca...
|
6.9 Medium | — | 0,54% | 10 Sep 2026 |
|
CVE-2026-87803
An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation...
|
7.1 High | — | 0,31% | 10 Sep 2026 |
|
CVE-2026-78082
Advisory
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing query buil...
|
9.3 Critical | — | 0,51% | 10 Sep 2026 |
|
CVE-2026-5399
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13...
|
6.4 Medium | — | 0,35% | 10 Sep 2026 |
|
CVE-2026-15889
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insuffi...
|
6.4 Medium | — | 0,15% | 10 Sep 2026 |
|
CVE-2026-88289
GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR reque...
|
7.5 High | — | 0,57% | 10 Sep 2026 |
|
CVE-2026-88290
GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exha...
|
7.5 High | — | 0,46% | 10 Sep 2026 |
|
CVE-2026-8323
URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of Data.
This...
|
9.3 Critical | — | 0,36% | 10 Sep 2026 |
|
CVE-2026-88280
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.
|
4.9 Medium | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-88281
GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and...
|
4.9 Medium | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-88282
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent F...
|
7.2 High | — | 0,54% | 10 Sep 2026 |
|
CVE-2026-88283
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state a...
|
4.9 Medium | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-88284
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and c...
|
4.9 Medium | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-88285
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or r...
|
9.4 Critical | — | 0,51% | 10 Sep 2026 |
|
CVE-2026-88286
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.
|
7.5 High | — | 0,46% | 10 Sep 2026 |
|
CVE-2026-88287
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack co...
|
7.5 High | — | 0,55% | 10 Sep 2026 |
|
CVE-2026-88288
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files access...
|
6.5 Medium | — | 0,55% | 10 Sep 2026 |
|
CVE-2026-88276
GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.
|
7.2 High | — | 0,71% | 10 Sep 2026 |
|
CVE-2026-88277
GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.
|
8.8 High | — | 0,65% | 10 Sep 2026 |
|
CVE-2026-88278
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for sub...
|
9.8 Critical | — | 0,48% | 10 Sep 2026 |
|
CVE-2026-88279
GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ON...
|
4.9 Medium | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-88271
GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.
|
8.8 High | — | 0,42% | 10 Sep 2026 |
|
CVE-2026-88272
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username...
|
7.2 High | — | 0,54% | 10 Sep 2026 |
|
CVE-2026-88273
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.
|
7.2 High | — | 0,71% | 10 Sep 2026 |
|
CVE-2026-88274
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.
|
7.2 High | — | 0,71% | 10 Sep 2026 |
|
CVE-2026-88275
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied...
|
7.2 High | — | 0,71% | 10 Sep 2026 |
|
CVE-2026-88264
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path...
|
5.6 Medium | — | 0,12% | 10 Sep 2026 |
|
CVE-2026-88265
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownershi...
|
5.6 Medium | — | 0,12% | 10 Sep 2026 |