Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-21113
samsung visual voicemail
Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission.
|
5.5 Medium | — | 0,08% | 9 Sep 2026 |
|
CVE-2026-21099
samsung android
Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information.
|
5.5 Medium | — | 0,09% | 9 Sep 2026 |
|
CVE-2026-21100
samsung android
Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity.
|
7.1 High | — | 0,09% | 9 Sep 2026 |
|
CVE-2026-21101
samsung android
Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege.
|
6.7 Medium | — | 0,12% | 9 Sep 2026 |
|
CVE-2026-21102
samsung android
Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.
|
6.7 Medium | — | 0,12% | 9 Sep 2026 |
|
CVE-2026-21103
samsung android
Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege.
|
6.1 Medium | — | 0,18% | 9 Sep 2026 |
|
CVE-2026-21104
samsung android
Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code.
|
6.7 Medium | — | 0,10% | 9 Sep 2026 |
|
CVE-2026-21105
samsung collection
Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information.
|
5.5 Medium | — | 0,09% | 9 Sep 2026 |
|
CVE-2026-21098
samsung android
Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction.
|
6.1 Medium | — | 0,09% | 9 Sep 2026 |
|
CVE-2026-21090
samsung android
Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
|
7.8 High | — | 0,10% | 9 Sep 2026 |
|
CVE-2026-21091
samsung android
Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
|
7.8 High | — | 0,10% | 9 Sep 2026 |
|
CVE-2026-21092
samsung android
Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege.
|
5.3 Medium | — | 0,32% | 9 Sep 2026 |
|
CVE-2026-21093
samsung android
Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.
|
6.7 Medium | — | 0,09% | 9 Sep 2026 |
|
CVE-2026-21094
samsung android
Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.
|
8.8 High | — | 0,16% | 9 Sep 2026 |
|
CVE-2026-21095
samsung android
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
|
9.8 Critical | — | 0,46% | 9 Sep 2026 |
|
CVE-2026-21096
samsung android
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
|
9.8 Critical | — | 0,46% | 9 Sep 2026 |
|
CVE-2026-21097
samsung android
Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity.
|
6.7 Medium | — | 0,12% | 9 Sep 2026 |
|
CVE-2026-21085
samsung android
Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.
|
6.7 Medium | — | 0,11% | 9 Sep 2026 |
|
CVE-2026-21086
samsung android
Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration.
|
7.8 High | — | 0,11% | 9 Sep 2026 |
|
CVE-2026-21087
samsung android
Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege.
|
7.8 High | — | 0,12% | 9 Sep 2026 |
|
CVE-2026-21088
samsung android
Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
|
7.8 High | — | 0,11% | 9 Sep 2026 |
|
CVE-2026-21089
samsung android
Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
|
7.8 High | — | 0,11% | 9 Sep 2026 |
|
CVE-2026-19945
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2.1 due to in...
|
6.4 Medium | — | 0,22% | 9 Sep 2026 |
|
CVE-2026-11821
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inc...
|
5.4 Medium | — | 0,19% | 9 Sep 2026 |
|
CVE-2026-84293
The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, a...
|
7.2 High | — | 0,51% | 9 Sep 2026 |
|
CVE-2026-81644
DoS vulnerability in the preview service module.
Impact: Successful exploitation of this vulnerability may affect availability.
|
4.3 Medium | — | 0,23% | 9 Sep 2026 |
|
CVE-2026-81646
Out-of-bounds read vulnerability in the graphics module.
Impact: Successful exploitation of this vulnerability may affect availability.
|
5.9 Medium | — | 0,13% | 9 Sep 2026 |
|
CVE-2026-81647
Out-of-bounds read vulnerability in the graphics module.
Impact: Successful exploitation of this vulnerability may affect availability.
|
5.3 Medium | — | 0,36% | 9 Sep 2026 |
|
CVE-2026-7804
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and incl...
|
6.1 Medium | — | 0,46% | 9 Sep 2026 |
|
CVE-2026-77187
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions...
|
6.4 Medium | — | 0,33% | 9 Sep 2026 |
|
CVE-2026-77186
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and...
|
6.4 Medium | — | 0,36% | 9 Sep 2026 |
|
CVE-2026-75966
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to...
|
6.4 Medium | — | 0,45% | 9 Sep 2026 |
|
CVE-2026-6485
UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.
|
8.2 High | — | 0,18% | 9 Sep 2026 |
|
CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
|
5.7 Medium | — | 0,47% | 9 Sep 2026 |
|
CVE-2026-49313
Permission control vulnerability in the app lock module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
|
5.5 Medium | — | 0,11% | 9 Sep 2026 |
|
CVE-2026-49314
OOB write vulnerability in the rendering and composition module.
Impact: Successful exploitation of this vulnerability may affect availability.
|
7.3 High | — | 0,12% | 9 Sep 2026 |
|
CVE-2026-49315
DoS vulnerability in the input device module.
Impact: Successful exploitation of this vulnerability may affect availability.
|
7.1 High | — | 0,11% | 9 Sep 2026 |
|
CVE-2026-49310
Permission control vulnerability in the event notification module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
|
8.6 High | — | 0,45% | 9 Sep 2026 |
|
CVE-2026-49311
Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability.
|
6.2 Medium | — | 0,13% | 9 Sep 2026 |
|
CVE-2026-49312
Permission control vulnerability in the window module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
|
4.0 Medium | — | 0,10% | 9 Sep 2026 |
|
CVE-2026-49309
Permission control vulnerability in the Settings module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
|
4.8 Medium | — | 0,11% | 9 Sep 2026 |
|
CVE-2026-41987
Permission control vulnerability in the app management module.
Impact: Successful exploitation of this vulnerability may affect availability.
|
6.2 Medium | — | 0,11% | 9 Sep 2026 |
|
CVE-2026-19797
The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and including, 2...
|
6.1 Medium | — | 0,22% | 9 Sep 2026 |
|
CVE-2026-19800
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all v...
|
4.9 Medium | — | 0,31% | 9 Sep 2026 |
|
CVE-2026-19944
The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficie...
|
4.9 Medium | — | 0,26% | 9 Sep 2026 |
|
CVE-2026-17553
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options()...
|
7.2 High | — | 0,43% | 9 Sep 2026 |
|
CVE-2026-12855
Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.
|
8.2 High | — | 0,13% | 9 Sep 2026 |
|
CVE-2026-11363
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via...
|
6.6 Medium | — | 0,66% | 9 Sep 2026 |
|
CVE-2026-87084
tanium enforce
Tanium addressed a server-side request forgery vulnerability in Enforce.
|
7.7 High | — | 0,34% | 9 Sep 2026 |
|
CVE-2026-87088
tanium enforce
Tanium addressed an unauthorized code execution vulnerability in Enforce.
|
7.0 High | — | 0,17% | 9 Sep 2026 |