Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-19397
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to t...
|
7.7 High | — | 0,20% | 8 Sep 2026 |
|
CVE-2026-18023
Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory vi...
|
5.7 Medium | — | 0,09% | 8 Sep 2026 |
|
CVE-2026-16003
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted...
|
2.0 Low | — | 0,09% | 8 Sep 2026 |
|
CVE-2026-16004
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requ...
|
5.9 Medium | — | 0,09% | 8 Sep 2026 |
|
CVE-2026-16005
Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verific...
|
5.8 Medium | — | 0,09% | 8 Sep 2026 |
|
CVE-2026-16006
Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IO...
|
5.7 Medium | — | 0,09% | 8 Sep 2026 |
|
CVE-2026-12962
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit...
|
5.3 Medium | — | 0,36% | 8 Sep 2026 |
|
CVE-2026-86510
A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads...
|
9.9 Critical | — | 0,51% | 8 Sep 2026 |
|
CVE-2026-86509
A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipula...
|
9.6 Critical | — | 0,72% | 8 Sep 2026 |
|
CVE-2026-76963
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive...
|
4.3 Medium | — | 0,28% | 8 Sep 2026 |
|
CVE-2026-76967
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileg...
|
7.8 High | — | 0,36% | 8 Sep 2026 |
|
CVE-2026-76968
SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality o...
|
6.5 Medium | — | 0,39% | 8 Sep 2026 |
|
CVE-2026-76969
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated...
|
9.4 Critical | — | 0,44% | 8 Sep 2026 |
|
CVE-2026-76971
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outb...
|
6.5 Medium | — | 0,25% | 8 Sep 2026 |
|
CVE-2026-76977
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass frami...
|
4.3 Medium | — | 0,37% | 8 Sep 2026 |
|
CVE-2026-82710
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control seq...
|
2.3 Low | — | 0,66% | 8 Sep 2026 |
|
CVE-2026-76958
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could s...
|
8.5 High | — | 0,38% | 8 Sep 2026 |
|
CVE-2026-76959
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low p...
|
4.6 Medium | — | 0,13% | 8 Sep 2026 |
|
CVE-2026-76960
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low...
|
3.5 Low | — | 0,14% | 8 Sep 2026 |
|
CVE-2026-76961
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low...
|
3.5 Low | — | 0,14% | 8 Sep 2026 |
|
CVE-2026-76962
SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send sp...
|
4.3 Medium | — | 0,34% | 8 Sep 2026 |
|
CVE-2026-66768
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit...
|
9.0 Critical | — | 0,61% | 8 Sep 2026 |
|
CVE-2026-66767
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously b...
|
7.7 High | — | 0,43% | 8 Sep 2026 |
|
CVE-2026-58240
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker wi...
|
9.8 Critical | — | 0,53% | 8 Sep 2026 |
|
CVE-2026-58234
SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain condit...
|
2.2 Low | — | 0,34% | 8 Sep 2026 |
|
CVE-2026-44756
A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a cr...
|
10.0 Critical | — | 1,4% | 8 Sep 2026 |
|
CVE-2026-44766
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed...
|
6.5 Medium | — | 0,39% | 8 Sep 2026 |
|
CVE-2026-86542
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can s...
|
9.1 Critical | — | 0,74% | 7 Sep 2026 |
|
CVE-2026-86543
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Atta...
|
9.8 Critical | — | 0,86% | 7 Sep 2026 |
|
CVE-2026-86544
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with...
|
8.1 High | — | 0,59% | 7 Sep 2026 |
|
CVE-2026-86439
knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project...
|
8.8 High | — | 1,1% | 7 Sep 2026 |
|
CVE-2026-86538
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary f...
|
7.5 High | — | 0,98% | 7 Sep 2026 |
|
CVE-2026-86539
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplie...
|
7.2 High | — | 0,35% | 7 Sep 2026 |
|
CVE-2026-86540
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by...
|
7.8 High | — | 0,21% | 7 Sep 2026 |
|
CVE-2026-86541
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the pr...
|
8.3 High | — | 0,77% | 7 Sep 2026 |
|
CVE-2026-82758
Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Clien...
|
6.3 Medium | — | 0,69% | 7 Sep 2026 |
|
CVE-2026-82753
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database...
|
8.2 High | — | 0,66% | 7 Sep 2026 |
|
CVE-2026-82754
Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL pre...
|
6.3 Medium | — | 0,69% | 7 Sep 2026 |
|
CVE-2026-82755
Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discove...
|
6.3 Medium | — | 0,66% | 7 Sep 2026 |
|
CVE-2026-82756
Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authenticatio...
|
6.3 Medium | — | 0,68% | 7 Sep 2026 |
|
CVE-2026-82757
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make...
|
6.3 Medium | — | 0,66% | 7 Sep 2026 |
|
CVE-2026-82586
Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-li...
|
8.2 High | — | 0,52% | 7 Sep 2026 |
|
CVE-2026-82584
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install c...
|
2.3 Low | — | 0,53% | 7 Sep 2026 |
|
CVE-2026-81638
Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifie...
|
2.1 Low | — | 0,19% | 7 Sep 2026 |
|
CVE-2026-86437
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrato...
|
7.2 High | — | 0,71% | 7 Sep 2026 |
|
CVE-2026-86438
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Atta...
|
7.2 High | — | 1,1% | 7 Sep 2026 |
|
CVE-2026-86436
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to...
|
5.4 Medium | — | 0,53% | 7 Sep 2026 |
|
CVE-2026-75650
Advisory
adobe commerce
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the...
|
10.0 Critical | KEV | 3,9% | 7 Sep 2026 |
|
CVE-2026-86287
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.
Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits...
|
7.5 High | — | 0,61% | 7 Sep 2026 |
|
CVE-2026-16028
Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table.
When a stream...
|
7.5 High | — | 0,37% | 7 Sep 2026 |