Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-16876
An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tamperi...
|
9.3 Critical | — | 0,33% | 7 Sep 2026 |
|
CVE-2026-86237
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test_default_model of the file sdk/src/openagents/sdk/transport...
|
5.3 Medium | — | 0,54% | 7 Sep 2026 |
|
CVE-2026-86238
A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedb...
|
4.3 Medium | — | 0,45% | 7 Sep 2026 |
|
CVE-2026-86236
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/pro_transac.php?action=add. S...
|
6.3 Medium | — | 0,33% | 7 Sep 2026 |
|
CVE-2026-86235
A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/pos_transac.php?action=add. This manipula...
|
6.3 Medium | — | 0,33% | 7 Sep 2026 |
|
CVE-2026-86233
A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/us_del....
|
6.3 Medium | — | 0,33% | 7 Sep 2026 |
|
CVE-2026-86234
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/cust_transac.php?action=add. The manipulation...
|
6.3 Medium | — | 0,33% | 7 Sep 2026 |
|
CVE-2026-86231
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Perfor...
|
3.7 Low | — | 0,42% | 6 Sep 2026 |
|
CVE-2026-86232
A weakness has been identified in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_del.php?t...
|
6.3 Medium | — | 0,33% | 6 Sep 2026 |
|
CVE-2026-86304
MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor.
pa...
|
9.8 Critical | — | 0,31% | 6 Sep 2026 |
|
CVE-2026-86227
A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the ar...
|
3.1 Low | — | 0,52% | 6 Sep 2026 |
|
CVE-2026-86228
A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot...
|
4.3 Medium | — | 0,39% | 6 Sep 2026 |
|
CVE-2026-86225
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqli_query of the file /admin/mod...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86226
A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipu...
|
3.5 Low | — | 0,33% | 6 Sep 2026 |
|
CVE-2026-86224
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Ex...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86222
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqli_query of the file /admin/modal_add_course2.php. S...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86223
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqli_query of the file /admin/modal_add_coursea.php. Perfor...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86221
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_course1.php....
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86219
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.
server_start generates a fre...
|
9.8 Critical | — | 0,47% | 6 Sep 2026 |
|
CVE-2026-86220
A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected element is the function mysqli_query of the file /admin/modal_add_cours...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-82208
haxx curl
With the wolfSSL backend, when CA caching is enabled and an
`CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can
silently reinstall the cached store...
|
7.5 High | — | 0,41% | 6 Sep 2026 |
|
CVE-2026-82209
haxx curl
When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a `Set-Cookie` header where the `Domain`
attribute explicit...
|
8.2 High | — | 0,37% | 6 Sep 2026 |
|
CVE-2026-80229
haxx curl
When performing transfers via libcurl’s multi interface, pooled TLS
connections can outlive their originating easy handles. In OpenSSL 3 provider
configurations, libcurl...
|
7.5 High | — | 0,56% | 6 Sep 2026 |
|
CVE-2026-80230
haxx curl
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable
standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and
`CURLOPT_SSL_VERIFYHOST = 0`), li...
|
7.5 High | — | 0,37% | 6 Sep 2026 |
|
CVE-2026-80231
haxx curl
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup
for a given hostname even when using a different Native CA Store setting
(`CURLSSLOPT_NATIVE_C...
|
7.5 High | — | 0,90% | 6 Sep 2026 |
|
CVE-2026-80255
haxx curl
A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of
space (ascii code 32) immediately before the `Secure` attribute causes curl to
store the cookie...
|
7.5 High | — | 0,48% | 6 Sep 2026 |
|
CVE-2026-18924
haxx curl
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent
handle is set to share connections with other handles, can lead to
use-after-free in the clean...
|
9.1 Critical | — | 0,58% | 6 Sep 2026 |
|
CVE-2026-19931
haxx curl
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given
hostname using Negotiate authentication, when the initial request is done
using empty creden...
|
9.8 Critical | — | 0,75% | 6 Sep 2026 |
|
CVE-2026-13608
haxx curl
A flaw in the libcurl SASL negotiation for LDAP authentication allows an
incomplete handshake sequence to be misinterpreted as a successful
cryptographic verification. An...
|
7.4 High | — | 0,48% | 6 Sep 2026 |
|
CVE-2026-82751
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a l...
|
8.3 High | — | 0,52% | 6 Sep 2026 |
|
CVE-2026-82750
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a l...
|
8.3 High | — | 0,52% | 6 Sep 2026 |
|
CVE-2026-83534
PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with superuser pr...
|
6.4 Medium | — | 0,19% | 6 Sep 2026 |
|
CVE-2026-19634
PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object name...
|
6.4 Medium | — | 0,19% | 6 Sep 2026 |
|
CVE-2026-19633
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that...
|
8.8 High | — | 0,42% | 6 Sep 2026 |
|
CVE-2026-86217
A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of the componen...
|
5.3 Medium | — | 0,53% | 6 Sep 2026 |
|
CVE-2026-86283
MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's acces...
|
7.1 High | — | 0,37% | 6 Sep 2026 |
|
CVE-2026-86216
A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The ma...
|
4.3 Medium | — | 0,47% | 6 Sep 2026 |
|
CVE-2026-86215
A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the component Logout...
|
4.3 Medium | — | 0,36% | 6 Sep 2026 |
|
CVE-2026-86213
A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/university.php of the component Search...
|
7.3 High | — | 0,43% | 6 Sep 2026 |
|
CVE-2026-86214
A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the argument e...
|
7.3 High | — | 0,65% | 6 Sep 2026 |
|
CVE-2026-86258
nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attack...
|
5.9 Medium | — | 0,52% | 6 Sep 2026 |
|
CVE-2026-86259
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services....
|
7.5 High | — | 0,42% | 6 Sep 2026 |
|
CVE-2026-86252
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by includi...
|
5.3 Medium | — | 0,36% | 6 Sep 2026 |
|
CVE-2026-86253
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent...
|
5.9 Medium | — | 0,62% | 6 Sep 2026 |
|
CVE-2026-86254
wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer...
|
6.8 Medium | — | 0,37% | 6 Sep 2026 |
|
CVE-2026-86255
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attacker...
|
6.5 Medium | — | 0,44% | 6 Sep 2026 |
|
CVE-2026-86256
wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersona...
|
5.4 Medium | — | 0,23% | 6 Sep 2026 |
|
CVE-2026-86257
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers...
|
5.4 Medium | — | 0,28% | 6 Sep 2026 |
|
CVE-2026-86205
h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header p...
|
5.4 Medium | — | 0,27% | 6 Sep 2026 |
|
CVE-2026-86212
A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization....
|
4.3 Medium | — | 0,49% | 6 Sep 2026 |