Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-77654
Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter I...
|
6.1 Medium | — | 0,14% | 8 Sep 2026 |
|
CVE-2026-19614
The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled.
This issue affects NanoXML: 2.2.3.
|
5.3 Medium | — | 0,23% | 8 Sep 2026 |
|
CVE-2026-86590
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HT...
|
6.3 Medium | — | 0,39% | 8 Sep 2026 |
|
CVE-2026-85400
Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This...
|
7.5 High | — | 0,46% | 8 Sep 2026 |
|
CVE-2026-9331
The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missin...
|
7.1 High | — | 0,35% | 8 Sep 2026 |
|
CVE-2026-77132
It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privilege...
|
5.3 Medium | — | 0,43% | 8 Sep 2026 |
|
CVE-2026-86550
NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This res...
|
6.5 Medium | — | 0,46% | 8 Sep 2026 |
|
CVE-2026-86597
Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryp...
|
6.5 Medium | — | 0,09% | 8 Sep 2026 |
|
CVE-2026-74859
The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write file...
|
6.8 Medium | — | 0,17% | 8 Sep 2026 |
|
CVE-2026-71376
OS command injection vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before...
|
9.8 Critical | — | 1,8% | 8 Sep 2026 |
|
CVE-2026-71377
Command Argument Injection Vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60...
|
9.8 Critical | — | 0,56% | 8 Sep 2026 |
|
CVE-2026-67367
A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All...
|
8.6 High | — | 1,1% | 8 Sep 2026 |
|
CVE-2026-62649
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing a high volu...
|
7.5 High | — | 0,57% | 8 Sep 2026 |
|
CVE-2026-62650
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enfor...
|
8.8 High | — | 0,57% | 8 Sep 2026 |
|
CVE-2026-62652
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from which debugging symbols have not been removed. Thi...
|
5.3 Medium | — | 0,35% | 8 Sep 2026 |
|
CVE-2026-62653
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device...
|
6.8 Medium | — | 0,28% | 8 Sep 2026 |
|
CVE-2026-62654
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, i...
|
6.8 Medium | — | 0,16% | 8 Sep 2026 |
|
CVE-2026-62645
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current an...
|
9.8 Critical | — | 0,65% | 8 Sep 2026 |
|
CVE-2026-62646
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting...
|
7.4 High | — | 0,51% | 8 Sep 2026 |
|
CVE-2026-62647
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session ident...
|
7.4 High | — | 0,56% | 8 Sep 2026 |
|
CVE-2026-62648
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly...
|
7.5 High | — | 0,57% | 8 Sep 2026 |
|
CVE-2026-58113
A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512....
|
6.1 Medium | — | 0,39% | 8 Sep 2026 |
|
CVE-2026-50093
A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance...
|
9.0 Critical | — | 0,32% | 8 Sep 2026 |
|
CVE-2026-34223
A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Des...
|
8.2 High | — | 0,19% | 8 Sep 2026 |
|
CVE-2026-81798
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS.
This issue affects Easy App...
|
7.1 High | — | 0,25% | 8 Sep 2026 |
|
CVE-2026-81802
Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.
|
6.5 Medium | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-81806
Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery.
This issue affects Hide My WP Ghost: from n/a throug...
|
7.2 High | — | 0,27% | 8 Sep 2026 |
|
CVE-2026-84817
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.
|
7.1 High | — | 0,25% | 8 Sep 2026 |
|
CVE-2026-84818
Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.
|
7.1 High | — | 0,25% | 8 Sep 2026 |
|
CVE-2026-84820
Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.
|
7.1 High | — | 0,25% | 8 Sep 2026 |
|
CVE-2026-81781
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affec...
|
7.1 High | — | 0,32% | 8 Sep 2026 |
|
CVE-2026-81790
Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Leve...
|
7.5 High | — | 0,35% | 8 Sep 2026 |
|
CVE-2026-81792
Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalati...
|
6.5 Medium | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-76561
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profil...
|
7.2 High | — | 0,68% | 8 Sep 2026 |
|
CVE-2026-71374
Deserialization of untrusted data vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from...
|
9.8 Critical | — | 0,56% | 8 Sep 2026 |
|
CVE-2026-71375
Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 b...
|
7.4 High | — | 0,41% | 8 Sep 2026 |
|
CVE-2026-48888
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.
This issue affects WooCommerce: from n/a before 11.1.0.
|
7.5 High | — | 0,46% | 8 Sep 2026 |
|
CVE-2026-86519
A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backup File Hand...
|
5.3 Medium | — | 0,53% | 8 Sep 2026 |
|
CVE-2026-86516
A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oid...
|
4.7 Medium | — | 0,40% | 8 Sep 2026 |
|
CVE-2026-86517
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query of the file /pages/us_searchfrm.php. Executing a m...
|
6.3 Medium | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-86518
A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the argument ID le...
|
6.3 Medium | — | 0,33% | 8 Sep 2026 |
|
CVE-2026-86511
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/...
|
5.3 Medium | — | 0,70% | 8 Sep 2026 |
|
CVE-2026-86512
A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/g...
|
6.3 Medium | — | 0,37% | 8 Sep 2026 |
|
CVE-2026-86513
A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file src/main/jav...
|
5.3 Medium | — | 0,70% | 8 Sep 2026 |
|
CVE-2026-86514
A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the component txth-txtp. This manipulation...
|
6.3 Medium | — | 0,47% | 8 Sep 2026 |
|
CVE-2026-86515
A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c of the component txtp. Such man...
|
4.3 Medium | — | 0,59% | 8 Sep 2026 |
|
CVE-2026-75811
Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify hardware configuration settings and potentially cause...
|
5.8 Medium | — | 0,14% | 8 Sep 2026 |
|
CVE-2026-75808
Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition through system memory exhaustion by...
|
5.7 Medium | — | 0,15% | 8 Sep 2026 |
|
CVE-2026-75809
Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver...
|
5.9 Medium | — | 0,15% | 8 Sep 2026 |
|
CVE-2026-75810
Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing driver authentication and sending requests to tri...
|
5.7 Medium | — | 0,15% | 8 Sep 2026 |