Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-86765
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit per...
|
6.5 Medium | — | 0,40% | 9 Sep 2026 |
|
CVE-2026-86766
snipeitapp snipe-it
Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout)....
|
6.5 Medium | — | 0,35% | 9 Sep 2026 |
|
CVE-2026-86757
snipeitapp snipe-it
Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime p...
|
6.5 Medium | — | 0,37% | 9 Sep 2026 |
|
CVE-2026-86758
snipeitapp snipe-it
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.vie...
|
6.5 Medium | — | 0,41% | 9 Sep 2026 |
|
CVE-2026-86759
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs....
|
7.1 High | — | 0,37% | 9 Sep 2026 |
|
CVE-2026-86760
snipeitapp snipe-it
Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user ed...
|
5.4 Medium | — | 0,38% | 9 Sep 2026 |
|
CVE-2026-86761
snipeitapp snipe-it
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticat...
|
4.3 Medium | — | 0,36% | 9 Sep 2026 |
|
CVE-2026-86750
snipeitapp snipe-it
Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::stor...
|
7.7 High | — | 0,33% | 9 Sep 2026 |
|
CVE-2026-86751
snipeitapp snipe-it
Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side H...
|
9.6 Critical | — | 0,37% | 9 Sep 2026 |
|
CVE-2026-86752
snipeitapp snipe-it
snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authori...
|
5.4 Medium | — | 0,25% | 9 Sep 2026 |
|
CVE-2026-86753
snipeitapp snipe-it
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can...
|
4.3 Medium | — | 0,28% | 9 Sep 2026 |
|
CVE-2026-86754
snipeitapp snipe-it
Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-co...
|
7.3 High | — | 0,34% | 9 Sep 2026 |
|
CVE-2026-86755
snipeitapp snipe-it
Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*) with only...
|
5.4 Medium | — | 0,27% | 9 Sep 2026 |
|
CVE-2026-86756
snipeitapp snipe-it
Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the...
|
6.1 Medium | — | 0,33% | 9 Sep 2026 |
|
CVE-2026-86744
snipeitapp snipe-it
Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths. Api\AssetsController::checkout() and A...
|
2.2 Low | — | 0,27% | 9 Sep 2026 |
|
CVE-2026-86745
snipeitapp snipe-it
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downlo...
|
6.5 Medium | — | 0,36% | 9 Sep 2026 |
|
CVE-2026-86746
snipeitapp snipe-it
Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifec...
|
6.4 Medium | — | 0,29% | 9 Sep 2026 |
|
CVE-2026-86747
snipeitapp snipe-it
Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unaccepted_assets/sent_reminde...
|
5.4 Medium | — | 0,25% | 9 Sep 2026 |
|
CVE-2026-86748
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip file...
|
6.1 Medium | — | 0,40% | 9 Sep 2026 |
|
CVE-2026-86749
snipeitapp snipe-it
Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default dis...
|
6.3 Medium | — | 0,34% | 9 Sep 2026 |
|
CVE-2026-86739
snipeitapp snipe-it
Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController...
|
6.5 Medium | — | 0,36% | 9 Sep 2026 |
|
CVE-2026-86740
snipeitapp snipe-it
Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing del...
|
3.8 Low | — | 0,29% | 9 Sep 2026 |
|
CVE-2026-86741
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions...
|
8.5 High | — | 0,35% | 9 Sep 2026 |
|
CVE-2026-86742
snipeitapp snipe-it
Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds t...
|
6.5 Medium | — | 0,41% | 9 Sep 2026 |
|
CVE-2026-86743
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances ac...
|
5.0 Medium | — | 0,29% | 9 Sep 2026 |
|
CVE-2026-86200
PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by inject...
|
5.3 Medium | — | 0,64% | 9 Sep 2026 |
|
CVE-2026-86201
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties ca...
|
7.5 High | — | 0,61% | 9 Sep 2026 |
|
CVE-2026-86202
PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for al...
|
4.3 Medium | — | 0,35% | 9 Sep 2026 |
|
CVE-2026-86203
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attackin...
|
3.7 Low | — | 0,35% | 9 Sep 2026 |
|
CVE-2026-86204
PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attac...
|
6.5 Medium | — | 0,44% | 9 Sep 2026 |
|
CVE-2026-86198
PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handlin...
|
4.2 Medium | — | 0,38% | 9 Sep 2026 |
|
CVE-2026-86199
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitial...
|
7.5 High | — | 0,47% | 9 Sep 2026 |
|
CVE-2026-86099
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting...
|
8.2 High | — | 0,60% | 9 Sep 2026 |
|
CVE-2026-79740
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An...
|
7.5 High | — | 0,41% | 9 Sep 2026 |
|
CVE-2026-79950
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An...
|
7.5 High | — | 0,41% | 9 Sep 2026 |
|
CVE-2026-79952
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Encoding or Escaping of Output vulnera...
|
5.3 Medium | — | 0,35% | 9 Sep 2026 |
|
CVE-2026-79964
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Escape, Meta, or Con...
|
5.3 Medium | — | 0,35% | 9 Sep 2026 |
|
CVE-2026-79971
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Sanitization of Custom Special Charact...
|
5.3 Medium | — | 0,36% | 9 Sep 2026 |
|
CVE-2026-79731
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An...
|
4.4 Medium | — | 0,31% | 9 Sep 2026 |
|
CVE-2026-79738
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An...
|
7.5 High | — | 0,41% | 9 Sep 2026 |
|
CVE-2026-78483
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability....
|
5.9 Medium | — | 0,20% | 9 Sep 2026 |
|
CVE-2026-78486
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerabili...
|
4.4 Medium | — | 0,31% | 9 Sep 2026 |
|
CVE-2026-73324
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network...
|
4.3 Medium | — | 0,24% | 9 Sep 2026 |
|
CVE-2026-64857
tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes t...
|
5.3 Medium | — | 0,47% | 9 Sep 2026 |
|
CVE-2026-56711
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and m...
|
7.0 High | — | 0,12% | 9 Sep 2026 |
|
CVE-2024-58380
PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is...
|
6.5 Medium | — | 0,38% | 9 Sep 2026 |
|
CVE-2024-58381
PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malforme...
|
7.5 High | — | 0,43% | 9 Sep 2026 |
|
CVE-2024-58382
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers...
|
7.5 High | — | 0,28% | 9 Sep 2026 |
|
CVE-2025-71417
PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to t...
|
6.5 Medium | — | 0,31% | 9 Sep 2026 |
|
CVE-2025-71418
PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send craf...
|
5.3 Medium | — | 0,40% | 9 Sep 2026 |