Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-88268
GeoVision GV-LPC2211
V1.13 contains an authenticated stack buffer overflow in SSVR fragment
reassembly that allows a valid user to crash the SSVR service.
|
6.5 Medium | — | 0,41% | 10 Sep 2026 |
|
CVE-2026-88269
GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR.
|
6.5 Medium | — | 0,34% | 10 Sep 2026 |
|
CVE-2026-88270
GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.
|
6.5 Medium | — | 0,37% | 10 Sep 2026 |
|
CVE-2026-84042
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled...
|
7.8 High | — | 0,10% | 10 Sep 2026 |
|
CVE-2026-59679
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but t...
|
9.0 Critical | — | 0,26% | 10 Sep 2026 |
|
CVE-2026-42805
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message...
|
8.4 High | — | 0,19% | 10 Sep 2026 |
|
CVE-2026-42806
An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic...
|
4.3 Medium | — | 0,21% | 10 Sep 2026 |
|
CVE-2026-42807
A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denia...
|
8.0 High | — | 0,31% | 10 Sep 2026 |
|
CVE-2026-42808
An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11.
The host streaming API function {{coines_read_stream_sensor_data()}} fails to validat...
|
6.8 Medium | — | 0,27% | 10 Sep 2026 |
|
CVE-2026-44950
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source sli...
|
9.0 Critical | — | 0,26% | 10 Sep 2026 |
|
CVE-2026-42804
A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a.
The vulnerabil...
|
7.6 High | — | 0,25% | 10 Sep 2026 |
|
CVE-2026-13745
A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrus...
|
7.7 High | — | 0,38% | 10 Sep 2026 |
|
CVE-2026-88763
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue oc...
|
5.9 Medium | — | 0,53% | 10 Sep 2026 |
|
CVE-2026-88770
A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fai...
|
6.5 Medium | — | 0,35% | 10 Sep 2026 |
|
CVE-2026-80352
apache camel
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K.
A YAML injection vulnerability in custom resource configuration allows an au...
|
9.8 Critical | — | 0,84% | 10 Sep 2026 |
|
CVE-2026-80354
apache camel
Authorization bypass through User-Controlled key vulnerability in Apache Camel K.
An authorization vulnerability in custom resource resolution allows a tenant to refer...
|
8.1 High | — | 0,50% | 10 Sep 2026 |
|
CVE-2026-80351
apache camel
Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K.
An improper neutralization of directives in dyn...
|
9.8 Critical | — | 1,0% | 10 Sep 2026 |
|
CVE-2026-7188
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allow...
|
9.8 Critical | — | 0,47% | 10 Sep 2026 |
|
CVE-2026-81431
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, read...
|
7.2 High | — | 0,46% | 10 Sep 2026 |
|
CVE-2026-81635
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website u...
|
5.1 Medium | — | 0,24% | 10 Sep 2026 |
|
CVE-2026-82582
An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's s...
|
5.3 Medium | — | 0,31% | 10 Sep 2026 |
|
CVE-2026-82925
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's W...
|
8.1 High | — | 0,45% | 10 Sep 2026 |
|
CVE-2026-77771
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attack...
|
7.5 High | — | 0,32% | 10 Sep 2026 |
|
CVE-2026-78361
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and...
|
9.1 Critical | — | 0,45% | 10 Sep 2026 |
|
CVE-2026-77770
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whos...
|
10.0 Critical | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-19436
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collecte...
|
7.5 High | — | 0,21% | 10 Sep 2026 |
|
CVE-2026-19439
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated u...
|
7.5 High | — | 0,26% | 10 Sep 2026 |
|
CVE-2026-19840
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, all...
|
6.5 Medium | — | 0,23% | 10 Sep 2026 |
|
CVE-2026-0303
A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-...
|
2.4 Low | — | 0,19% | 10 Sep 2026 |
|
CVE-2026-0304
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execu...
|
4.8 Medium | — | 0,22% | 10 Sep 2026 |
|
CVE-2026-0302
An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov.
|
1.1 Low | — | 0,82% | 10 Sep 2026 |
|
CVE-2026-82079
A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an attacker within wireless range to execute arbitrar...
|
8.4 High | — | 0,26% | 10 Sep 2026 |
|
CVE-2026-85645
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parame...
|
6.1 Medium | — | 0,38% | 10 Sep 2026 |
|
CVE-2026-84939
apache freemarker
Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the...
|
9.1 Critical | — | 0,85% | 10 Sep 2026 |
|
CVE-2026-0310
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the...
|
7.2 High | — | 0,44% | 10 Sep 2026 |
|
CVE-2026-0306
A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enf...
|
5.8 Medium | — | 0,11% | 10 Sep 2026 |
|
CVE-2026-0307
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM o...
|
5.9 Medium | — | 0,11% | 10 Sep 2026 |
|
CVE-2026-0308
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript...
|
1.1 Low | — | 0,28% | 10 Sep 2026 |
|
CVE-2026-0309
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands a...
|
4.0 Medium | — | 0,51% | 10 Sep 2026 |
|
CVE-2026-0305
An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credential...
|
4.3 Medium | — | 0,10% | 10 Sep 2026 |
|
CVE-2026-75880
apache artemis
An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, o...
|
6.5 Medium | — | 0,65% | 10 Sep 2026 |
|
CVE-2026-57822
apache artemis
When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management...
|
6.5 Medium | — | 0,71% | 10 Sep 2026 |
|
CVE-2026-57967
apache artemis
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authentic...
|
9.8 Critical | — | 1,5% | 10 Sep 2026 |
|
CVE-2026-67593
apache artemis
A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and aut...
|
9.1 Critical | — | 0,86% | 10 Sep 2026 |
|
CVE-2026-49363
apache artemis
An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication....
|
7.5 High | — | 0,80% | 10 Sep 2026 |
|
CVE-2026-49364
apache artemis
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake.
This i...
|
9.1 Critical | — | 0,57% | 10 Sep 2026 |
|
CVE-2026-49362
apache artemis
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of se...
|
7.5 High | — | 0,82% | 10 Sep 2026 |
|
CVE-2026-76562
The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbm_description' parameter in all versions up to, and including, 1.18...
|
7.2 High | — | 0,40% | 10 Sep 2026 |
|
CVE-2026-4657
The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control_selectors meta field in all versions up to, and including, 2.0.4....
|
6.4 Medium | — | 0,42% | 10 Sep 2026 |
|
CVE-2026-15820
The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including,...
|
6.4 Medium | — | 0,19% | 10 Sep 2026 |