Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-66819
microsoft sql server 2017, microsoft sql server 2019 +2 lainnya
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
|
8.8 High | — | 0,99% | 8 Sep 2026 |
|
CVE-2026-66820
microsoft sql server 2017, microsoft sql server 2019 +2 lainnya
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
|
8.8 High | — | 0,99% | 8 Sep 2026 |
|
CVE-2026-66814
microsoft sql server 2017, microsoft sql server 2019 +2 lainnya
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
|
8.8 High | — | 0,78% | 8 Sep 2026 |
|
CVE-2026-65812
microsoft teams
Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
|
6.8 Medium | — | 0,89% | 8 Sep 2026 |
|
CVE-2026-65772
microsoft dynamics 365
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
|
8.8 High | — | 1,7% | 8 Sep 2026 |
|
CVE-2026-65669
microsoft sql server management studio
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges ove...
|
9.6 Critical | — | 0,86% | 8 Sep 2026 |
|
CVE-2026-64918
microsoft 365 apps, microsoft office 2016 +3 lainnya
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.
|
6.5 Medium | — | 0,87% | 8 Sep 2026 |
|
CVE-2026-62895
microsoft azure arc sql server extension
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
|
8.8 High | — | 0,80% | 8 Sep 2026 |
|
CVE-2026-62804
microsoft 365 apps, microsoft 365 +4 lainnya
External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.
|
7.8 High | — | 0,61% | 8 Sep 2026 |
|
CVE-2026-62810
microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-62813
microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya
Use after free in Active Directory Domain Services allows an authorized attacker to execute code over a network.
|
7.5 High | — | 0,66% | 8 Sep 2026 |
|
CVE-2026-62801
microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya
Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a n...
|
6.5 Medium | — | 0,76% | 8 Sep 2026 |
|
CVE-2026-62762
microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
|
6.5 Medium | — | 1,1% | 8 Sep 2026 |
|
CVE-2026-62759
microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya
Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network.
|
7.5 High | — | 0,38% | 8 Sep 2026 |
|
CVE-2026-62744
microsoft windows 11 24h2, microsoft windows 11 25h2 +2 lainnya
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,82% | 8 Sep 2026 |
|
CVE-2026-62706
microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,82% | 8 Sep 2026 |
|
CVE-2026-62694
microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,26% | 8 Sep 2026 |
|
CVE-2026-62697
microsoft windows 10 21h2, microsoft windows 10 22h2 +6 lainnya
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-58611
microsoft xbox gaming services
Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,31% | 8 Sep 2026 |
|
CVE-2026-58649
microsoft .net, microsoft .net sdk +2 lainnya
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
|
6.5 Medium | — | 0,27% | 8 Sep 2026 |
|
CVE-2026-58599
microsoft hevc video extensions, microsoft hevc video extensions for licensed applications +1 lainnya
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
|
7.8 High | — | 0,47% | 8 Sep 2026 |
|
CVE-2026-58600
microsoft hevc video extensions, microsoft hevc video extensions for licensed applications +1 lainnya
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally.
|
7.8 High | — | 0,47% | 8 Sep 2026 |
|
CVE-2026-57099
microsoft asp.net core odata
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
|
7.5 High | — | 1,2% | 8 Sep 2026 |
|
CVE-2026-57098
microsoft remote desktop client
Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.
|
7.5 High | — | 0,64% | 8 Sep 2026 |
|
CVE-2026-56172
microsoft windows 10 1809, microsoft windows 10 21h2 +8 lainnya
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-56177
microsoft windows 10 1607, microsoft windows 10 1809 +10 lainnya
Use after free in Windows Server allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-56198
microsoft windows 11 24h2, microsoft windows 11 25h2 +2 lainnya
Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-55007
microsoft exchange server, microsoft exchange server subscription edition
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
|
8.1 High | — | 0,71% | 8 Sep 2026 |
|
CVE-2026-54611
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attacke...
|
5.5 Medium | — | 0,66% | 8 Sep 2026 |
|
CVE-2026-50349
microsoft windows 10 1607, microsoft windows 10 1809 +11 lainnya
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker...
|
7.0 High | — | 0,20% | 8 Sep 2026 |
|
CVE-2026-48707
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functi...
|
3.1 Low | — | 0,27% | 8 Sep 2026 |
|
CVE-2026-47297
microsoft sql server 2019, microsoft sql server 2022 +1 lainnya
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
|
8.1 High | — | 1,1% | 8 Sep 2026 |
|
CVE-2026-86667
A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function member_list of the file controllers/member.php. This manipulati...
|
4.7 Medium | — | 0,35% | 8 Sep 2026 |
|
CVE-2026-86668
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such ma...
|
4.3 Medium | — | 0,47% | 8 Sep 2026 |
|
CVE-2026-86073
n8n
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented...
|
7.6 High | — | 0,39% | 8 Sep 2026 |
|
CVE-2026-84385
A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR Paa...
|
5.4 Medium | — | 0,23% | 8 Sep 2026 |
|
CVE-2026-84386
A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control...
|
5.1 Medium | — | 0,14% | 8 Sep 2026 |
|
CVE-2026-84387
A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, Fort...
|
7.2 High | — | 1,4% | 8 Sep 2026 |
|
CVE-2026-84389
A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute...
|
3.1 Low | — | 0,22% | 8 Sep 2026 |
|
CVE-2026-84391
A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insert attack vector here>
|
6.5 Medium | — | 0,41% | 8 Sep 2026 |
|
CVE-2026-84392
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions...
|
2.7 Low | — | 1,1% | 8 Sep 2026 |
|
CVE-2026-84393
A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to inform...
|
8.1 High | — | 0,28% | 8 Sep 2026 |
|
CVE-2026-82533
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting...
|
9.6 Critical | — | 1,2% | 8 Sep 2026 |
|
CVE-2026-82070
mongodb
A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials...
|
6.5 Medium | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-82071
mongodb
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during c...
|
8.1 High | — | 0,54% | 8 Sep 2026 |
|
CVE-2026-82073
mongodb
A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and acces...
|
6.5 Medium | — | 0,36% | 8 Sep 2026 |
|
CVE-2026-82074
mongodb
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatt...
|
6.5 Medium | — | 0,36% | 8 Sep 2026 |
|
CVE-2026-82075
mongodb
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a rou...
|
7.5 High | — | 0,52% | 8 Sep 2026 |
|
CVE-2026-82076
mongodb
An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an inte...
|
6.5 Medium | — | 0,41% | 8 Sep 2026 |
|
CVE-2026-82063
mongodb
A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing cond...
|
5.3 Medium | — | 0,37% | 8 Sep 2026 |