Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-82064
mongodb
A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an as...
|
7.5 High | — | 0,52% | 8 Sep 2026 |
|
CVE-2026-82065
mongodb
A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of...
|
6.5 Medium | — | 0,40% | 8 Sep 2026 |
|
CVE-2026-82066
mongodb
A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigg...
|
8.1 High | — | 0,39% | 8 Sep 2026 |
|
CVE-2026-82067
mongodb
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled st...
|
8.1 High | — | 0,51% | 8 Sep 2026 |
|
CVE-2026-82068
mongodb
A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable...
|
6.5 Medium | — | 0,40% | 8 Sep 2026 |
|
CVE-2026-82069
mongodb
A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from othe...
|
6.5 Medium | — | 0,41% | 8 Sep 2026 |
|
CVE-2026-82057
mongodb
A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger...
|
6.5 Medium | — | 0,42% | 8 Sep 2026 |
|
CVE-2026-82058
mongodb
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document c...
|
6.5 Medium | — | 0,40% | 8 Sep 2026 |
|
CVE-2026-82059
mongodb
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster o...
|
6.5 Medium | — | 0,37% | 8 Sep 2026 |
|
CVE-2026-82060
mongodb
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped o...
|
5.4 Medium | — | 0,34% | 8 Sep 2026 |
|
CVE-2026-82061
mongodb
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed...
|
8.1 High | — | 0,53% | 8 Sep 2026 |
|
CVE-2026-82062
mongodb
A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying...
|
5.5 Medium | — | 0,45% | 8 Sep 2026 |
|
CVE-2026-82053
mongodb
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication und...
|
8.1 High | — | 0,41% | 8 Sep 2026 |
|
CVE-2026-82054
mongodb
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSch...
|
6.5 Medium | — | 0,40% | 8 Sep 2026 |
|
CVE-2026-82055
mongodb
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON docum...
|
6.5 Medium | — | 0,40% | 8 Sep 2026 |
|
CVE-2026-82056
mongodb
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecy...
|
5.3 Medium | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-82052
mongodb
The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific condi...
|
6.5 Medium | — | 0,50% | 8 Sep 2026 |
|
CVE-2026-81531
An information
disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization
remains accessible after completi...
|
6.9 Medium | — | 0,67% | 8 Sep 2026 |
|
CVE-2026-79569
Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensit...
|
9.8 Critical | — | 0,47% | 8 Sep 2026 |
|
CVE-2026-79570
mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to...
|
9.8 Critical | — | 0,47% | 8 Sep 2026 |
|
CVE-2026-78997
UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitra...
|
9.3 Critical | — | 0,40% | 8 Sep 2026 |
|
CVE-2026-75156
apache-airflow-providers-fab
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only...
|
9.1 Critical | — | 0,38% | 8 Sep 2026 |
|
CVE-2026-78216
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Qu...
|
6.0 Medium | — | 0,43% | 8 Sep 2026 |
|
CVE-2026-78230
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate...
|
6.0 Medium | — | 0,43% | 8 Sep 2026 |
|
CVE-2026-52307
An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web script...
|
5.4 Medium | — | 0,29% | 8 Sep 2026 |
|
CVE-2026-47625
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might le...
|
7.5 High | — | 0,56% | 8 Sep 2026 |
|
CVE-2026-26084
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandb...
|
9.9 Critical | — | 0,39% | 8 Sep 2026 |
|
CVE-2026-22575
An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Clou...
|
4.9 Medium | — | 0,25% | 8 Sep 2026 |
|
CVE-2026-20293
A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attack...
|
7.1 High | — | 0,16% | 8 Sep 2026 |
|
CVE-2026-16497
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead...
|
7.5 High | — | 0,47% | 8 Sep 2026 |
|
CVE-2026-86840
The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbit...
|
9.1 Critical | — | 0,42% | 8 Sep 2026 |
|
CVE-2026-86853
mozilla firefox mobile
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily un...
|
4.3 Medium | — | 0,28% | 8 Sep 2026 |
|
CVE-2026-86735
snipeitapp snipe-it
snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encod...
|
5.0 Medium | — | 0,31% | 8 Sep 2026 |
|
CVE-2026-86736
snipeitapp snipe-it
snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter...
|
4.3 Medium | — | 0,30% | 8 Sep 2026 |
|
CVE-2026-86737
snipeitapp snipe-it
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to re...
|
4.3 Medium | — | 0,28% | 8 Sep 2026 |
|
CVE-2026-86738
snipeitapp snipe-it
Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than an...
|
8.7 High | — | 0,49% | 8 Sep 2026 |
|
CVE-2026-86731
Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action r...
|
6.5 Medium | — | 0,31% | 8 Sep 2026 |
|
CVE-2026-86732
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arb...
|
8.8 High | — | 0,85% | 8 Sep 2026 |
|
CVE-2026-86733
snipeitapp snipe-it
Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag,...
|
7.2 High | — | 0,58% | 8 Sep 2026 |
|
CVE-2026-86734
snipeitapp snipe-it
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded i...
|
6.5 Medium | — | 0,55% | 8 Sep 2026 |
|
CVE-2026-86729
WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_ap...
|
7.4 High | — | 0,38% | 8 Sep 2026 |
|
CVE-2026-86730
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachme...
|
8.8 High | — | 0,71% | 8 Sep 2026 |
|
CVE-2026-86724
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows at...
|
6.5 Medium | — | 0,17% | 8 Sep 2026 |
|
CVE-2026-86725
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that all...
|
7.1 High | — | 0,35% | 8 Sep 2026 |
|
CVE-2026-86726
AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and i...
|
6.5 Medium | — | 0,36% | 8 Sep 2026 |
|
CVE-2026-86727
AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8...
|
7.5 High | — | 0,53% | 8 Sep 2026 |
|
CVE-2026-86728
AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenti...
|
7.5 High | — | 0,55% | 8 Sep 2026 |
|
CVE-2026-86721
AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] param...
|
7.5 High | — | 0,50% | 8 Sep 2026 |
|
CVE-2026-86722
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never i...
|
8.1 High | — | 0,48% | 8 Sep 2026 |
|
CVE-2026-86723
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() that uses loose comparison (==)...
|
8.1 High | — | 0,48% | 8 Sep 2026 |