Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-23855
Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralizati...
|
7.2 High | — | 0,93% | 9 Sep 2026 |
|
CVE-2026-18147
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page...
|
8.1 High | — | 0,42% | 9 Sep 2026 |
|
CVE-2026-19233
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a pri...
|
8.6 High | — | 0,70% | 9 Sep 2026 |
|
CVE-2026-82563
An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status responses, o...
|
7.6 High | — | 0,24% | 9 Sep 2026 |
|
CVE-2026-81640
An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and m...
|
8.8 High | — | 0,30% | 9 Sep 2026 |
|
CVE-2026-81330
The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured...
|
6.5 Medium | — | 0,09% | 9 Sep 2026 |
|
CVE-2026-79741
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements use...
|
5.3 Medium | — | 3,5% | 9 Sep 2026 |
|
CVE-2026-79942
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerabi...
|
3.4 Low | — | 0,15% | 9 Sep 2026 |
|
CVE-2026-79944
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high...
|
3.4 Low | — | 0,13% | 9 Sep 2026 |
|
CVE-2026-79945
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements use...
|
5.5 Medium | — | 2,3% | 9 Sep 2026 |
|
CVE-2026-79946
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax...
|
5.3 Medium | — | 0,35% | 9 Sep 2026 |
|
CVE-2026-79947
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements use...
|
5.5 Medium | — | 1,8% | 9 Sep 2026 |
|
CVE-2026-79689
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements use...
|
9.8 Critical | — | 4,7% | 9 Sep 2026 |
|
CVE-2026-79693
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high...
|
3.4 Low | — | 0,13% | 9 Sep 2026 |
|
CVE-2026-79735
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerabili...
|
4.4 Medium | — | 0,32% | 9 Sep 2026 |
|
CVE-2026-78484
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements use...
|
7.8 High | — | 2,5% | 9 Sep 2026 |
|
CVE-2026-78493
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements use...
|
7.8 High | — | 2,5% | 9 Sep 2026 |
|
CVE-2026-77974
After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsign...
|
8.0 High | — | 0,27% | 9 Sep 2026 |
|
CVE-2026-68484
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing aut...
|
9.0 Critical | — | 0,27% | 9 Sep 2026 |
|
CVE-2026-67403
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to a...
|
9.0 Critical | — | 0,27% | 9 Sep 2026 |
|
CVE-2026-67401
Advisory
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
|
9.9 Critical | — | 0,86% | 9 Sep 2026 |
|
CVE-2026-22590
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3...
|
9.1 Critical | — | 0,38% | 9 Sep 2026 |
|
CVE-2026-22591
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, a...
|
7.5 High | — | 0,32% | 9 Sep 2026 |
|
CVE-2026-87877
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call th...
|
7.7 High | — | 0,20% | 9 Sep 2026 |
|
CVE-2026-87822
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass v...
|
7.5 High | — | 0,67% | 9 Sep 2026 |
|
CVE-2026-87823
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or ov...
|
8.2 High | — | 0,43% | 9 Sep 2026 |
|
CVE-2026-87824
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying overs...
|
7.5 High | — | 0,39% | 9 Sep 2026 |
|
CVE-2026-87825
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictio...
|
7.7 High | — | 0,20% | 9 Sep 2026 |
|
CVE-2026-83530
google common expression language
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occ...
|
4.3 Medium | — | 0,15% | 9 Sep 2026 |
|
CVE-2026-82530
IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent...
|
5.3 Medium | — | 0,44% | 9 Sep 2026 |
|
CVE-2026-79732
dell secure connect gateway
Dell Secure Connect Gateway (SCG) 5.0 Appliance, versions prior to 5.36.00.xx, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with...
|
3.7 Low | — | 0,17% | 9 Sep 2026 |
|
CVE-2026-79736
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability....
|
3.7 Low | — | 0,19% | 9 Sep 2026 |
|
CVE-2026-79941
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements use...
|
9.8 Critical | — | 4,7% | 9 Sep 2026 |
|
CVE-2026-79617
Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting In...
|
7.1 High | — | 0,14% | 9 Sep 2026 |
|
CVE-2026-79690
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability....
|
3.7 Low | — | 0,19% | 9 Sep 2026 |
|
CVE-2026-79729
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability....
|
3.7 Low | — | 0,19% | 9 Sep 2026 |
|
CVE-2026-78482
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements use...
|
7.8 High | — | 2,5% | 9 Sep 2026 |
|
CVE-2026-26212
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privil...
|
7.2 High | — | 0,82% | 9 Sep 2026 |
|
CVE-2026-86773
snipeitapp snipe-it
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the s...
|
5.4 Medium | — | 0,25% | 9 Sep 2026 |
|
CVE-2026-86774
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing...
|
6.3 Medium | — | 0,29% | 9 Sep 2026 |
|
CVE-2026-86775
knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user...
|
8.6 High | — | 0,75% | 9 Sep 2026 |
|
CVE-2026-86767
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authe...
|
5.0 Medium | — | 0,33% | 9 Sep 2026 |
|
CVE-2026-86768
snipeitapp snipe-it
Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to tra...
|
5.4 Medium | — | 0,35% | 9 Sep 2026 |
|
CVE-2026-86769
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id...
|
4.3 Medium | — | 0,28% | 9 Sep 2026 |
|
CVE-2026-86770
snipeitapp snipe-it
Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP acc...
|
8.1 High | — | 0,57% | 9 Sep 2026 |
|
CVE-2026-86771
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tag...
|
7.6 High | — | 0,32% | 9 Sep 2026 |
|
CVE-2026-86772
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescap...
|
5.4 Medium | — | 0,25% | 9 Sep 2026 |
|
CVE-2026-86762
snipeitapp snipe-it
Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke tha...
|
8.1 High | — | 0,47% | 9 Sep 2026 |
|
CVE-2026-86763
snipeitapp snipe-it
Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.index route). T...
|
3.5 Low | — | 0,27% | 9 Sep 2026 |
|
CVE-2026-86764
snipeitapp snipe-it
Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/components....
|
6.5 Medium | — | 0,37% | 9 Sep 2026 |