Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2022-51018
PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can crea...
|
6.5 Medium | — | 0,42% | 7 Sep 2026 |
|
CVE-2022-51011
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send larg...
|
4.3 Medium | — | 0,43% | 7 Sep 2026 |
|
CVE-2022-51010
PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid...
|
6.5 Medium | — | 0,51% | 7 Sep 2026 |
|
CVE-2026-86299
A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest...
|
9.9 Critical | — | 3,7% | 7 Sep 2026 |
|
CVE-2026-86300
A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authent...
|
7.3 High | — | 0,84% | 7 Sep 2026 |
|
CVE-2026-86301
A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the comp...
|
3.5 Low | — | 0,35% | 7 Sep 2026 |
|
CVE-2026-86404
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-li...
|
8.8 High | — | 0,73% | 7 Sep 2026 |
|
CVE-2026-78325
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in t...
|
6.9 Medium | — | 0,12% | 7 Sep 2026 |
|
CVE-2026-2390
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. Th...
|
6.4 Medium | — | 0,19% | 7 Sep 2026 |
|
CVE-2026-86351
misp-project misp
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-re...
|
6.1 Medium | — | 0,26% | 7 Sep 2026 |
|
CVE-2026-86294
A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of...
|
4.3 Medium | — | 0,47% | 7 Sep 2026 |
|
CVE-2026-86295
A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of...
|
8.3 High | — | 2,3% | 7 Sep 2026 |
|
CVE-2026-86296
A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This...
|
10.0 Critical | — | 1,7% | 7 Sep 2026 |
|
CVE-2026-86297
A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the comp...
|
8.1 High | — | 1,1% | 7 Sep 2026 |
|
CVE-2026-86298
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /delete_subject.php. Performing a...
|
7.3 High | — | 0,43% | 7 Sep 2026 |
|
CVE-2026-85201
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Co...
|
6.8 Medium | — | 0,16% | 7 Sep 2026 |
|
CVE-2026-85640
Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component
|
6.3 Medium | — | 0,38% | 7 Sep 2026 |
|
CVE-2026-82325
A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control...
|
6.8 Medium | — | 0,14% | 7 Sep 2026 |
|
CVE-2026-77699
Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path.
|
5.0 Medium | — | 0,29% | 7 Sep 2026 |
|
CVE-2026-77697
Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction
|
6.3 Medium | — | 0,38% | 7 Sep 2026 |
|
CVE-2025-52652
HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a t...
|
3.5 Low | — | 0,15% | 7 Sep 2026 |
|
CVE-2025-52657
HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system perf...
|
3.5 Low | — | 0,16% | 7 Sep 2026 |
|
CVE-2026-19204
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially ex...
|
8.7 High | — | 0,31% | 7 Sep 2026 |
|
CVE-2025-52651
HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues.
|
3.5 Low | — | 0,15% | 7 Sep 2026 |
|
CVE-2026-86292
A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation....
|
7.3 High | — | 0,69% | 7 Sep 2026 |
|
CVE-2026-86293
A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the c...
|
6.5 Medium | — | 0,76% | 7 Sep 2026 |
|
CVE-2026-86347
misp-project misp
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. Thi...
|
6.5 Medium | — | 0,43% | 7 Sep 2026 |
|
CVE-2026-86291
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/us_edit1.php. Such manipula...
|
6.3 Medium | — | 0,33% | 7 Sep 2026 |
|
CVE-2026-84173
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is...
|
8.3 High | — | 0,16% | 7 Sep 2026 |
|
CVE-2026-77698
Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade.
|
5.7 Medium | — | 0,35% | 7 Sep 2026 |
|
CVE-2026-86285
A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/At...
|
4.3 Medium | — | 0,39% | 7 Sep 2026 |
|
CVE-2026-86288
A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file gptqmodel/nn_modules/qlinear/tritonv2.py of the co...
|
6.3 Medium | — | 0,51% | 7 Sep 2026 |
|
CVE-2026-86289
A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a...
|
4.3 Medium | — | 0,69% | 7 Sep 2026 |
|
CVE-2026-86290
A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=save_category. This manipu...
|
7.3 High | — | 0,43% | 7 Sep 2026 |
|
CVE-2026-86332
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard s...
|
6.5 Medium | — | 0,42% | 7 Sep 2026 |
|
CVE-2026-86342
misp-project misp
Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes f...
|
4.3 Medium | — | 0,34% | 7 Sep 2026 |
|
CVE-2026-84732
Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a...
|
8.7 High | — | 0,34% | 7 Sep 2026 |
|
CVE-2026-84186
Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwar...
|
6.9 Medium | — | 0,54% | 7 Sep 2026 |
|
CVE-2026-18796
Any application that
uses external QSPI flash for encrypted XIP on nRF5340 and relies on that
encryption for confidentiality and/or integrity of the externally...
|
6.8 Medium | — | 0,08% | 7 Sep 2026 |
|
CVE-2026-14297
A buffer overflow in the Bluetooth Continuous Glucose
Monitoring Service (CGMS) Record Access Control Point (RACP) write handler
allows an authenticated BLE pee...
|
8.7 High | — | 0,16% | 7 Sep 2026 |
|
CVE-2026-86281
A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performing a manipu...
|
4.3 Medium | — | 0,23% | 7 Sep 2026 |
|
CVE-2026-86282
A weakness has been identified in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected is an unknown function of the file tra...
|
7.3 High | — | 0,45% | 7 Sep 2026 |
|
CVE-2026-86284
A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is t...
|
5.3 Medium | — | 0,55% | 7 Sep 2026 |
|
CVE-2026-86280
A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This affects an unknown function of the file cict_portal.s...
|
5.3 Medium | — | 0,35% | 7 Sep 2026 |
|
CVE-2026-84226
OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configura...
|
8.5 High | — | 0,14% | 7 Sep 2026 |
|
CVE-2026-84256
An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a...
|
7.7 High | — | 0,38% | 7 Sep 2026 |
|
CVE-2026-82312
OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects
|
1.8 Low | — | 0,10% | 7 Sep 2026 |
|
CVE-2026-81738
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries
|
2.3 Low | — | 0,33% | 7 Sep 2026 |
|
CVE-2026-81830
The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect fi...
|
5.6 Medium | — | 0,15% | 7 Sep 2026 |
|
CVE-2026-78043
The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arb...
|
5.6 Medium | — | 0,17% | 7 Sep 2026 |