Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-87431
google chrome
Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chr...
|
7.5 High | — | 0,32% | 9 Sep 2026 |
|
CVE-2026-87432
google chrome
Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via...
|
4.2 Medium | — | 0,22% | 9 Sep 2026 |
|
CVE-2026-87433
google chrome
Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafte...
|
8.8 High | — | 0,28% | 9 Sep 2026 |
|
CVE-2026-87434
google chrome
Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a...
|
3.1 Low | — | 0,24% | 9 Sep 2026 |
|
CVE-2026-87435
google chrome
Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive informa...
|
5.3 Medium | — | 0,28% | 9 Sep 2026 |
|
CVE-2026-87436
google chrome
Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Ch...
|
6.5 Medium | — | 0,31% | 9 Sep 2026 |
|
CVE-2026-87437
google chrome
Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security sev...
|
6.5 Medium | — | 0,32% | 9 Sep 2026 |
|
CVE-2026-53937
MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-c...
|
6.2 Medium | — | 0,19% | 9 Sep 2026 |
|
CVE-2026-53938
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap...
|
8.2 High | — | 0,24% | 9 Sep 2026 |
|
CVE-2026-53939
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-C...
|
9.1 Critical | — | 0,25% | 9 Sep 2026 |
|
CVE-2026-19201
google go-attestation
An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a den...
|
7.5 High | — | 0,27% | 9 Sep 2026 |
|
CVE-2026-86564
A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a ho...
|
3.3 Low | — | 0,14% | 8 Sep 2026 |
|
CVE-2026-55250
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycl...
|
8.7 High | — | 0,87% | 8 Sep 2026 |
|
CVE-2026-53581
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerabilit...
|
9.0 Critical | — | 0,47% | 8 Sep 2026 |
|
CVE-2026-53637
Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforce...
|
6.5 Medium | — | 0,36% | 8 Sep 2026 |
|
CVE-2026-53638
Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability e...
|
4.3 Medium | — | 0,28% | 8 Sep 2026 |
|
CVE-2026-53639
Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/payment-requests/...
|
6.3 Medium | — | 0,54% | 8 Sep 2026 |
|
CVE-2026-47680
The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets....
|
5.3 Medium | — | 0,46% | 8 Sep 2026 |
|
CVE-2026-18090
A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) f...
|
6.1 Medium | — | 0,17% | 8 Sep 2026 |
|
CVE-2026-86995
n8n
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstr...
|
4.3 Medium | — | 0,40% | 8 Sep 2026 |
|
CVE-2026-86996
n8n
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Work...
|
5.4 Medium | — | 0,29% | 8 Sep 2026 |
|
CVE-2026-86993
n8n
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and...
|
4.9 Medium | — | 0,46% | 8 Sep 2026 |
|
CVE-2026-86994
n8n
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the in...
|
4.3 Medium | — | 0,34% | 8 Sep 2026 |
|
CVE-2026-86081
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path ag...
|
7.1 High | — | 0,56% | 8 Sep 2026 |
|
CVE-2026-86082
n8n
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for...
|
6.5 Medium | — | 0,42% | 8 Sep 2026 |
|
CVE-2026-86083
n8n
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable globa...
|
8.8 High | — | 0,66% | 8 Sep 2026 |
|
CVE-2026-86084
n8n
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when...
|
5.5 Medium | — | 0,46% | 8 Sep 2026 |
|
CVE-2026-86085
n8n
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members end...
|
4.9 Medium | — | 0,44% | 8 Sep 2026 |
|
CVE-2026-86075
n8n
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrar...
|
7.5 High | — | 0,61% | 8 Sep 2026 |
|
CVE-2026-86076
n8n
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and...
|
8.8 High | — | 0,79% | 8 Sep 2026 |
|
CVE-2026-86077
n8n
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without ch...
|
6.5 Medium | — | 0,43% | 8 Sep 2026 |
|
CVE-2026-86078
n8n
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows...
|
6.5 Medium | — | 0,59% | 8 Sep 2026 |
|
CVE-2026-86079
n8n
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled in...
|
6.5 Medium | — | 0,49% | 8 Sep 2026 |
|
CVE-2026-86080
n8n
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub retu...
|
5.3 Medium | — | 0,26% | 8 Sep 2026 |
|
CVE-2026-81904
Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could view that sub...
|
6.3 Medium | — | 0,46% | 8 Sep 2026 |
|
CVE-2026-53933
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with d...
|
6.9 Medium | — | 0,54% | 8 Sep 2026 |
|
CVE-2026-85981
The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows...
|
6.7 Medium | — | 0,19% | 8 Sep 2026 |
|
CVE-2026-85982
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content disp...
|
9.0 Critical | — | 0,40% | 8 Sep 2026 |
|
CVE-2026-85983
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connecto...
|
7.8 High | — | 0,20% | 8 Sep 2026 |
|
CVE-2026-86819
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's cod...
|
7.1 High | — | 0,10% | 8 Sep 2026 |
|
CVE-2026-84685
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (S...
|
6.5 Medium | — | 0,28% | 8 Sep 2026 |
|
CVE-2026-81993
adobe acrobat, adobe acrobat dc +1 lainnya
Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability...
|
5.5 Medium | — | 0,30% | 8 Sep 2026 |
|
CVE-2026-81994
adobe acrobat, adobe acrobat dc +1 lainnya
Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file...
|
6.3 Medium | — | 0,60% | 8 Sep 2026 |
|
CVE-2026-81996
adobe acrobat, adobe acrobat dc +1 lainnya
Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerabili...
|
8.8 High | — | 0,24% | 8 Sep 2026 |
|
CVE-2026-81997
adobe acrobat, adobe acrobat dc +1 lainnya
Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to by...
|
6.3 Medium | — | 0,24% | 8 Sep 2026 |
|
CVE-2026-82001
adobe acrobat, adobe acrobat dc +1 lainnya
Acrobat Reader is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerab...
|
5.5 Medium | — | 0,23% | 8 Sep 2026 |
|
CVE-2026-81985
adobe acrobat, adobe acrobat dc +1 lainnya
Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue...
|
7.8 High | — | 0,38% | 8 Sep 2026 |
|
CVE-2026-81986
adobe acrobat, adobe acrobat dc +1 lainnya
Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue...
|
7.8 High | — | 0,38% | 8 Sep 2026 |
|
CVE-2026-81987
adobe acrobat, adobe acrobat dc +1 lainnya
Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitati...
|
7.8 High | — | 0,31% | 8 Sep 2026 |
|
CVE-2026-81988
adobe acrobat, adobe acrobat dc +1 lainnya
Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue...
|
7.8 High | — | 0,38% | 8 Sep 2026 |