Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-71801
An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is n...
|
9.8 Critical | — | 0,79% | 9 Sep 2026 |
|
CVE-2026-71802
A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping...
|
5.4 Medium | — | 0,23% | 9 Sep 2026 |
|
CVE-2026-71803
money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly...
|
5.4 Medium | — | 0,27% | 9 Sep 2026 |
|
CVE-2026-71808
A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenatio...
|
8.8 High | — | 0,51% | 9 Sep 2026 |
|
CVE-2026-50165
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605...
|
7.1 High | — | 0,35% | 9 Sep 2026 |
|
CVE-2026-53956
Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to version 0.24.0 w...
|
5.4 Medium | — | 0,33% | 9 Sep 2026 |
|
CVE-2026-36433
An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically proximate attacker execute arbitrary code via the Production.dll and Rdi...
|
9.8 Critical | — | 0,70% | 9 Sep 2026 |
|
CVE-2026-87911
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenti...
|
9.6 Critical | — | 1,7% | 9 Sep 2026 |
|
CVE-2026-79324
mageplaza gdpr
Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to de...
|
7.5 High | — | 0,56% | 9 Sep 2026 |
|
CVE-2026-73769
A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution. Successful...
|
7.2 High | — | 1,1% | 9 Sep 2026 |
|
CVE-2026-73786
A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack. Successful explo...
|
7.5 High | — | 0,57% | 9 Sep 2026 |
|
CVE-2026-73787
A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation cou...
|
7.2 High | — | 0,84% | 9 Sep 2026 |
|
CVE-2026-73788
A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable ClearPass OnGuard deployment....
|
6.5 Medium | — | 0,37% | 9 Sep 2026 |
|
CVE-2026-73789
A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate account setti...
|
5.3 Medium | — | 0,40% | 9 Sep 2026 |
|
CVE-2026-71616
An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object(). Fixed in 3c4e...
|
6.2 Medium | — | 0,16% | 9 Sep 2026 |
|
CVE-2026-71612
Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmx_process() function. Fixed in f...
|
8.4 High | — | 0,21% | 9 Sep 2026 |
|
CVE-2026-71613
Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdec_process() function. Fixed in 9a...
|
7.8 High | — | 0,20% | 9 Sep 2026 |
|
CVE-2026-71614
An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identif...
|
8.4 High | — | 0,22% | 9 Sep 2026 |
|
CVE-2026-61908
cyrus imap
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a c...
|
6.5 Medium | — | 0,22% | 9 Sep 2026 |
|
CVE-2026-61909
cyrus imap
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's...
|
4.3 Medium | — | 0,20% | 9 Sep 2026 |
|
CVE-2026-61910
cyrus imap
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on...
|
5.0 Medium | — | 0,19% | 9 Sep 2026 |
|
CVE-2026-61911
cyrus imap
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether ano...
|
4.3 Medium | — | 0,22% | 9 Sep 2026 |
|
CVE-2026-61915
cyrus imap
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH...
|
7.1 High | — | 0,26% | 9 Sep 2026 |
|
CVE-2026-38998
A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause...
|
6.5 Medium | — | 0,44% | 9 Sep 2026 |
|
CVE-2026-79323
mageplaza magefan blog
Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated...
|
7.5 High | — | 0,57% | 9 Sep 2026 |
|
CVE-2026-79322
mageplaza blog
SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to ex...
|
8.6 High | — | 0,48% | 9 Sep 2026 |
|
CVE-2026-61907
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's sno...
|
4.3 Medium | — | 0,21% | 9 Sep 2026 |
|
CVE-2026-54694
SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinc...
|
9.6 Critical | — | 0,47% | 9 Sep 2026 |
|
CVE-2026-52482
An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service spawns /app/sh_for_telnet
|
7.5 High | — | 0,53% | 9 Sep 2026 |
|
CVE-2026-39020
An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file
|
5.5 Medium | — | 0,14% | 9 Sep 2026 |
|
CVE-2025-51619
A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service (BSOD) condition on Windows s...
|
5.5 Medium | — | 0,10% | 9 Sep 2026 |
|
CVE-2026-8044
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with...
|
8.6 High | — | 0,67% | 9 Sep 2026 |
|
CVE-2026-87874
A flaw was found in the memcached cache plugin of the community.general Ansible
collection. Although its documentation states that records are stored in JSON
format, the...
|
8.1 High | — | 0,72% | 9 Sep 2026 |
|
CVE-2026-87875
The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds re...
|
4.3 Medium | — | 0,39% | 9 Sep 2026 |
|
CVE-2026-87876
Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filter...
|
3.0 Low | — | 0,33% | 9 Sep 2026 |
|
CVE-2026-87927
MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privi...
|
8.2 High | — | 0,59% | 9 Sep 2026 |
|
CVE-2026-87928
MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files....
|
5.4 Medium | — | 0,30% | 9 Sep 2026 |
|
CVE-2026-87929
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticat...
|
9.8 Critical | — | 0,53% | 9 Sep 2026 |
|
CVE-2026-87930
MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers ca...
|
8.1 High | — | 0,61% | 9 Sep 2026 |
|
CVE-2026-87853
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated u...
|
7.5 High | — | 0,33% | 9 Sep 2026 |
|
CVE-2026-87872
A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the
community.general Ansible collection. The shared OCAPI request helper disables
TLS certificate va...
|
6.8 Medium | — | 0,14% | 9 Sep 2026 |
|
CVE-2026-85788
Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only...
|
5.5 Medium | — | 0,18% | 9 Sep 2026 |
|
CVE-2026-80921
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: vsie: zero stale crypto bits
When shadowing crypto access bits from a format0 apcb (crycb...
|
8.8 High | — | 0,13% | 9 Sep 2026 |
|
CVE-2026-80924
In the Linux kernel, the following vulnerability has been resolved:
crypto: krb5 - use kfree_sensitive() for derived key buffers
crypto_krb5_prepare_encryption() and cr...
|
7.5 High | — | 0,32% | 9 Sep 2026 |
|
CVE-2026-80914
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
iso_conn_ready() looks up th...
|
8.8 High | — | 0,23% | 9 Sep 2026 |
|
CVE-2026-77120
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause privilege escalation to root and...
|
8.7 High | — | 0,67% | 9 Sep 2026 |
|
CVE-2026-70425
dell powerscale onefs
Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerabil...
|
6.7 Medium | — | 0,53% | 9 Sep 2026 |
|
CVE-2026-40635
dell powerscale onefs
Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this...
|
5.4 Medium | — | 0,39% | 9 Sep 2026 |
|
CVE-2026-47156
MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowin...
|
9.3 Critical | — | 0,69% | 9 Sep 2026 |
|
CVE-2026-46460
dell powerscale onefs
Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerabil...
|
3.5 Low | — | 0,19% | 9 Sep 2026 |