Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-12757
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode...
|
6.5 Medium | — | 0,33% | 7 Sep 2026 |
|
CVE-2026-8279
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in th...
|
5.3 Medium | — | 0,40% | 7 Sep 2026 |
|
CVE-2026-86435
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers...
|
7.5 High | — | 0,49% | 7 Sep 2026 |
|
CVE-2026-86440
misp-project misp
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget.
The widget's URL is stored configuration controlled by...
|
5.4 Medium | — | 0,24% | 7 Sep 2026 |
|
CVE-2026-86441
misp-project misp
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.
Several organisation-related widgets...
|
4.3 Medium | — | 0,28% | 7 Sep 2026 |
|
CVE-2026-86451
misp-project misp
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking wheth...
|
4.3 Medium | — | 0,27% | 7 Sep 2026 |
|
CVE-2026-86428
thephpleague commonmark
commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers c...
|
7.5 High | — | 0,49% | 7 Sep 2026 |
|
CVE-2026-86429
thephpleague commonmark
The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesEx...
|
7.5 High | — | 0,52% | 7 Sep 2026 |
|
CVE-2026-86430
thephpleague commonmark
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delim...
|
7.5 High | — | 0,49% | 7 Sep 2026 |
|
CVE-2026-86431
thephpleague commonmark
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute...
|
7.2 High | — | 0,39% | 7 Sep 2026 |
|
CVE-2026-86432
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attacker...
|
5.3 Medium | — | 0,42% | 7 Sep 2026 |
|
CVE-2026-86433
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() perfo...
|
7.5 High | — | 0,51% | 7 Sep 2026 |
|
CVE-2026-86434
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its nume...
|
7.5 High | — | 0,51% | 7 Sep 2026 |
|
CVE-2026-86422
imagemagick
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restric...
|
3.3 Low | — | 0,13% | 7 Sep 2026 |
|
CVE-2026-86423
imagemagick
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList met...
|
5.5 Medium | — | 0,11% | 7 Sep 2026 |
|
CVE-2026-86424
imagemagick
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy wri...
|
2.5 Low | — | 0,14% | 7 Sep 2026 |
|
CVE-2026-86425
imagemagick
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted...
|
5.5 Medium | — | 0,15% | 7 Sep 2026 |
|
CVE-2026-86426
librenms
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending nume...
|
9.8 Critical | — | 3,9% | 7 Sep 2026 |
|
CVE-2026-86427
librenms
LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments...
|
8.8 High | — | 0,61% | 7 Sep 2026 |
|
CVE-2026-86408
misp-project misp
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view().
The vulnerable handler que...
|
6.5 Medium | — | 0,34% | 7 Sep 2026 |
|
CVE-2026-86416
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perfo...
|
5.4 Medium | — | 0,45% | 7 Sep 2026 |
|
CVE-2026-86417
misp-project misp
Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates().
The query always fetched User.email, while redactio...
|
4.3 Medium | — | 0,27% | 7 Sep 2026 |
|
CVE-2026-86418
misp-project misp
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal...
|
4.3 Medium | — | 0,27% | 7 Sep 2026 |
|
CVE-2026-86419
misp-project misp
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.
In feed process...
|
9.1 Critical | — | 0,42% | 7 Sep 2026 |
|
CVE-2026-86420
imagemagick
ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures ca...
|
7.5 High | — | 0,32% | 7 Sep 2026 |
|
CVE-2026-86421
imagemagick
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, all...
|
7.5 High | — | 0,45% | 7 Sep 2026 |
|
CVE-2026-86302
A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql of the com...
|
5.3 Medium | — | 0,53% | 7 Sep 2026 |
|
CVE-2026-86303
A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a...
|
7.3 High | — | 0,54% | 7 Sep 2026 |
|
CVE-2026-86305
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the func...
|
7.3 High | — | 0,50% | 7 Sep 2026 |
|
CVE-2026-86306
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the fil...
|
7.3 High | — | 0,69% | 7 Sep 2026 |
|
CVE-2026-80135
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Condi...
|
5.3 Medium | — | 0,39% | 7 Sep 2026 |
|
CVE-2026-80178
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. A...
|
7.8 High | — | 0,14% | 7 Sep 2026 |
|
CVE-2026-80238
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerabi...
|
9.3 Critical | — | 0,19% | 7 Sep 2026 |
|
CVE-2026-79678
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding L...
|
8.1 High | — | 0,89% | 7 Sep 2026 |
|
CVE-2026-80132
dell secure connect gateway
ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vuln...
|
8.1 High | — | 0,47% | 7 Sep 2026 |
|
CVE-2026-80133
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauth...
|
8.1 High | — | 0,72% | 7 Sep 2026 |
|
CVE-2026-80134
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An...
|
7.7 High | — | 0,34% | 7 Sep 2026 |
|
CVE-2026-76578
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry....
|
9.8 Critical | — | 1,2% | 7 Sep 2026 |
|
CVE-2026-6431
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '...
|
7.2 High | — | 0,42% | 7 Sep 2026 |
|
CVE-2026-61409
dell secure connect gateway
Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Comman...
|
7.3 High | — | 1,5% | 7 Sep 2026 |
|
CVE-2026-61410
dell secure connect gateway
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthen...
|
9.4 Critical | — | 0,85% | 7 Sep 2026 |
|
CVE-2026-6223
Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass.
This issue affects BiHayat...
|
9.4 Critical | — | 0,58% | 7 Sep 2026 |
|
CVE-2026-4945
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,...
|
5.3 Medium | — | 0,39% | 7 Sep 2026 |
|
CVE-2026-12853
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that...
|
5.4 Medium | — | 0,31% | 7 Sep 2026 |
|
CVE-2022-51012
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send craf...
|
6.5 Medium | — | 0,51% | 7 Sep 2026 |
|
CVE-2022-51013
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-r...
|
6.5 Medium | — | 0,51% | 7 Sep 2026 |
|
CVE-2022-51014
PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can...
|
6.5 Medium | — | 0,51% | 7 Sep 2026 |
|
CVE-2022-51015
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within...
|
6.5 Medium | — | 0,68% | 7 Sep 2026 |
|
CVE-2022-51016
PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key...
|
6.1 Medium | — | 0,23% | 7 Sep 2026 |
|
CVE-2022-51017
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG...
|
7.5 High | — | 0,47% | 7 Sep 2026 |