Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR
·
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-86206
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
|
6.9 Medium | — | 1,1% | 5 Sep 2026 |
|
CVE-2026-86060
Advisory
mikrotik routeros
RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mas...
|
9.8 Critical | KEV | 6,4% | 5 Sep 2026 |
|
CVE-2026-67277
Advisory
mikrotik routeros
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start...
|
8.2 High | KEV | 1,6% | 5 Sep 2026 |
|
CVE-2026-67278
mikrotik routeros
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Beca...
|
9.1 Critical | — | 0,25% | 5 Sep 2026 |
|
CVE-2026-67279
Advisory
mikrotik routeros
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open...
|
6.5 Medium | KEV | 1,0% | 5 Sep 2026 |
|
CVE-2026-67281
mikrotik routeros
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer u...
|
7.5 High | — | 0,73% | 5 Sep 2026 |
|
CVE-2026-67276
Advisory
mikrotik routeros
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omittin...
|
8.1 High | — | 6,5% | 5 Sep 2026 |
|
CVE-2026-6554
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of l...
|
7.5 High | — | 0,31% | 5 Sep 2026 |
|
CVE-2026-86207
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs
|
7.7 High | — | 1,3% | 5 Sep 2026 |
|
CVE-2026-31911
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can termin...
|
5.5 Medium | — | 0,11% | 5 Sep 2026 |
|
CVE-2026-31912
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset...
|
5.5 Medium | — | 0,11% | 5 Sep 2026 |
|
CVE-2026-6244
libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted fil...
|
5.5 Medium | — | 0,15% | 5 Sep 2026 |
|
CVE-2026-18238
The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message...
|
5.0 Medium | — | 0,18% | 5 Sep 2026 |
|
CVE-2026-18313
rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it...
|
4.3 Medium | — | 0,23% | 5 Sep 2026 |
|
CVE-2026-0799
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF int...
|
8.7 High | — | 0,11% | 5 Sep 2026 |
|
CVE-2026-82752
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length con...
|
5.9 Medium | — | 0,18% | 5 Sep 2026 |
|
CVE-2026-86197
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper...
|
5.1 Medium | — | 0,41% | 5 Sep 2026 |
|
CVE-2026-86189
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a c...
|
9.8 Critical | — | 0,71% | 5 Sep 2026 |
|
CVE-2026-86190
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and...
|
9.1 Critical | — | 0,44% | 5 Sep 2026 |
|
CVE-2026-86191
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private at...
|
4.3 Medium | — | 0,28% | 5 Sep 2026 |
|
CVE-2026-86192
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValu...
|
6.5 Medium | — | 0,35% | 5 Sep 2026 |
|
CVE-2026-86193
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accoun...
|
8.7 High | — | 0,36% | 5 Sep 2026 |
|
CVE-2026-86194
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined o...
|
6.9 Medium | — | 0,56% | 5 Sep 2026 |
|
CVE-2026-86195
grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested su...
|
8.7 High | — | 0,39% | 5 Sep 2026 |
|
CVE-2026-86196
Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to re...
|
8.7 High | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-86186
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force...
|
6.5 Medium | — | 0,30% | 5 Sep 2026 |
|
CVE-2026-86187
WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to pa...
|
5.9 Medium | — | 0,36% | 5 Sep 2026 |
|
CVE-2026-86188
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' brow...
|
7.2 High | — | 0,43% | 5 Sep 2026 |
|
CVE-2026-86184
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any use...
|
9.8 Critical | — | 1,1% | 5 Sep 2026 |
|
CVE-2026-86185
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An atta...
|
8.0 High | — | 0,17% | 5 Sep 2026 |
|
CVE-2026-15550
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capabilit...
|
4.3 Medium | — | 0,16% | 5 Sep 2026 |
|
CVE-2026-12843
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is a...
|
5.4 Medium | — | 0,16% | 5 Sep 2026 |
|
CVE-2025-9049
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_membe...
|
8.8 High | — | 0,25% | 5 Sep 2026 |
|
CVE-2026-10196
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and i...
|
9.8 Critical | — | 0,66% | 5 Sep 2026 |
|
CVE-2025-15647
CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating point and rou...
|
5.5 Medium | — | 0,28% | 5 Sep 2026 |
|
CVE-2025-15614
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z file...
|
3.3 Low | — | 0,12% | 5 Sep 2026 |
|
CVE-2026-86175
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrie...
|
6.5 Medium | — | 0,46% | 5 Sep 2026 |
|
CVE-2026-86176
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users w...
|
4.3 Medium | — | 0,34% | 5 Sep 2026 |
|
CVE-2026-86177
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execut...
|
8.8 High | — | 0,58% | 5 Sep 2026 |
|
CVE-2026-86178
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stor...
|
5.4 Medium | — | 0,32% | 5 Sep 2026 |
|
CVE-2026-86169
Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the se...
|
8.8 High | — | 0,94% | 5 Sep 2026 |
|
CVE-2026-86173
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by su...
|
7.5 High | — | 0,65% | 5 Sep 2026 |
|
CVE-2026-86174
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitr...
|
4.3 Medium | — | 0,34% | 5 Sep 2026 |
|
CVE-2026-86118
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attack...
|
4.3 Medium | — | 0,47% | 5 Sep 2026 |
|
CVE-2026-86119
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORI...
|
8.6 High | — | 0,57% | 5 Sep 2026 |
|
CVE-2026-86120
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lo...
|
4.3 Medium | — | 0,37% | 5 Sep 2026 |
|
CVE-2026-86121
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unaut...
|
9.8 Critical | — | 1,1% | 5 Sep 2026 |
|
CVE-2026-86122
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these UR...
|
5.0 Medium | — | 0,37% | 5 Sep 2026 |
|
CVE-2026-86123
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specifi...
|
8.7 High | — | 0,49% | 5 Sep 2026 |
|
CVE-2026-86124
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root....
|
9.8 Critical | — | 0,98% | 5 Sep 2026 |