Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 11 kali dilihat
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-75925
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted...
|
9.6 Critical | — | 0,67% | 4 Sep 2026 |
|
CVE-2026-46636
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on inst...
|
8.7 High | — | 0,57% | 4 Sep 2026 |
|
CVE-2026-85787
An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor t...
|
6.5 Medium | — | 0,34% | 4 Sep 2026 |
|
CVE-2026-85704
A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file...
|
3.7 Low | — | 0,41% | 4 Sep 2026 |
|
CVE-2026-85703
A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server...
|
6.5 Medium | — | 0,55% | 4 Sep 2026 |
|
CVE-2026-85702
A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation of the fil...
|
7.3 High | — | 0,66% | 4 Sep 2026 |
|
CVE-2026-85701
A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the...
|
5.3 Medium | — | 0,63% | 4 Sep 2026 |
|
CVE-2026-82712
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state chan...
|
8.8 High | — | 0,25% | 4 Sep 2026 |
|
CVE-2026-79426
An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via craf...
|
7.2 High | — | 0,53% | 4 Sep 2026 |
|
CVE-2026-79423
An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST...
|
8.8 High | — | 0,85% | 4 Sep 2026 |
|
CVE-2026-77847
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensit...
|
6.5 Medium | — | 0,33% | 4 Sep 2026 |
|
CVE-2026-75439
An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component
|
7.5 High | — | 0,76% | 4 Sep 2026 |
|
CVE-2026-75438
Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function
|
7.5 High | — | 0,82% | 4 Sep 2026 |
|
CVE-2026-53769
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side...
|
6.5 Medium | — | 0,42% | 4 Sep 2026 |
|
CVE-2026-50894
easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to...
|
9.8 Critical | — | 0,86% | 4 Sep 2026 |
|
CVE-2025-67066
SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path
|
9.8 Critical | — | 0,50% | 4 Sep 2026 |
|
CVE-2022-26961
Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the...
|
5.4 Medium | — | 0,14% | 4 Sep 2026 |
|
CVE-2026-85786
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion docume...
|
7.5 High | — | 0,58% | 4 Sep 2026 |
|
CVE-2026-85643
A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulation of the ar...
|
4.7 Medium | — | 0,35% | 4 Sep 2026 |
|
CVE-2026-79391
No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing...
|
9.8 Critical | — | 0,72% | 4 Sep 2026 |
|
CVE-2026-79390
Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attack...
|
7.5 High | — | 0,41% | 4 Sep 2026 |
|
CVE-2026-79389
Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, incl...
|
7.4 High | — | 0,21% | 4 Sep 2026 |
|
CVE-2026-71626
An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.p...
|
7.5 High | — | 0,54% | 4 Sep 2026 |
|
CVE-2026-71625
An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component
|
9.8 Critical | — | 0,74% | 4 Sep 2026 |
|
CVE-2026-71624
An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.ph...
|
9.8 Critical | — | 0,93% | 4 Sep 2026 |
|
CVE-2026-71622
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component
|
7.4 High | — | 0,45% | 4 Sep 2026 |
|
CVE-2026-63464
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: t...
|
7.7 High | — | 0,46% | 4 Sep 2026 |
|
CVE-2026-61699
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboar...
|
8.1 High | — | 0,45% | 4 Sep 2026 |
|
CVE-2026-55513
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both t...
|
5.4 Medium | — | 0,32% | 4 Sep 2026 |
|
CVE-2026-55512
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable wi...
|
5.3 Medium | — | 0,60% | 4 Sep 2026 |
|
CVE-2026-53932
laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during...
|
8.0 High | — | 1,7% | 4 Sep 2026 |
|
CVE-2026-53604
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real *pki.CAResolver directly...
|
7.1 High | — | 0,18% | 4 Sep 2026 |
|
CVE-2026-53603
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_sessions tab...
|
7.1 High | — | 0,35% | 4 Sep 2026 |
|
CVE-2026-53602
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted o...
|
6.9 Medium | — | 0,31% | 4 Sep 2026 |
|
CVE-2026-85781
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user wi...
|
8.7 High | — | 0,44% | 4 Sep 2026 |
|
CVE-2026-85639
A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry Endpoint. Such...
|
5.6 Medium | — | 0,35% | 4 Sep 2026 |
|
CVE-2026-85638
A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization b...
|
7.3 High | — | 0,52% | 4 Sep 2026 |
|
CVE-2026-85637
A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Admin Endpoin...
|
5.3 Medium | — | 0,74% | 4 Sep 2026 |
|
CVE-2026-81939
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outs...
|
9.1 Critical | — | 0,68% | 4 Sep 2026 |
|
CVE-2026-80119
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability...
|
7.8 High | — | 0,18% | 4 Sep 2026 |
|
CVE-2026-80118
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disc...
|
7.1 High | — | 0,17% | 4 Sep 2026 |
|
CVE-2026-80117
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in...
|
7.1 High | — | 0,16% | 4 Sep 2026 |
|
CVE-2026-80116
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in...
|
7.8 High | — | 0,17% | 4 Sep 2026 |
|
CVE-2026-80115
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation and denial-of-se...
|
6.1 Medium | — | 0,15% | 4 Sep 2026 |
|
CVE-2026-80114
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability...
|
7.8 High | — | 0,19% | 4 Sep 2026 |
|
CVE-2026-80113
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in...
|
7.1 High | — | 0,16% | 4 Sep 2026 |
|
CVE-2026-80112
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerabilit...
|
7.8 High | — | 0,15% | 4 Sep 2026 |
|
CVE-2026-78839
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.
|
8.1 High | — | 0,55% | 4 Sep 2026 |
|
CVE-2026-78328
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privil...
|
9.1 Critical | — | 0,46% | 4 Sep 2026 |
|
CVE-2026-78327
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Manage...
|
9.1 Critical | — | 1,6% | 4 Sep 2026 |