Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 20 kali dilihat
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-75162
An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any remote auth...
|
6.5 Medium | — | 0,65% | 4 Sep 2026 |
|
CVE-2026-75161
An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged St...
|
8.8 High | — | 0,77% | 4 Sep 2026 |
|
CVE-2026-75160
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.
|
9.1 Critical | — | 0,60% | 4 Sep 2026 |
|
CVE-2026-5522
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentica...
|
6.7 Medium | — | 0,12% | 4 Sep 2026 |
|
CVE-2026-44402
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers t...
|
9.8 Critical | — | 1,3% | 4 Sep 2026 |
|
CVE-2026-19649
ibm app connect enterprise, ibm integration bus for z/os
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attac...
|
5.5 Medium | — | 0,11% | 4 Sep 2026 |
|
CVE-2026-19645
IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that c...
|
6.5 Medium | — | 0,29% | 4 Sep 2026 |
|
CVE-2026-19306
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key,...
|
7.7 High | — | 0,40% | 4 Sep 2026 |
|
CVE-2026-19305
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.
|
7.5 High | — | 0,29% | 4 Sep 2026 |
|
CVE-2026-19304
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.
|
7.7 High | — | 0,31% | 4 Sep 2026 |
|
CVE-2026-19303
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname...
|
8.1 High | — | 0,40% | 4 Sep 2026 |
|
CVE-2026-19302
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.
|
6.5 Medium | — | 0,49% | 4 Sep 2026 |
|
CVE-2026-19301
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
|
6.5 Medium | — | 0,29% | 4 Sep 2026 |
|
CVE-2026-19300
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.
|
7.5 High | — | 0,38% | 4 Sep 2026 |
|
CVE-2026-19299
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
|
6.5 Medium | — | 0,49% | 4 Sep 2026 |
|
CVE-2026-19298
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.
|
8.8 High | — | 0,50% | 4 Sep 2026 |
|
CVE-2026-19283
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive informati...
|
7.7 High | — | 0,31% | 4 Sep 2026 |
|
CVE-2026-19274
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently de...
|
9.6 Critical | — | 0,21% | 4 Sep 2026 |
|
CVE-2026-18905
ibm contextforge
IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a...
|
7.7 High | — | 0,34% | 4 Sep 2026 |
|
CVE-2026-18887
ibm i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access informa...
|
6.5 Medium | — | 0,28% | 4 Sep 2026 |
|
CVE-2026-18858
ibm i
IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.
|
5.5 Medium | — | 0,10% | 4 Sep 2026 |
|
CVE-2026-18658
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can exec...
|
9.8 Critical | — | 0,43% | 4 Sep 2026 |
|
CVE-2026-18567
ibm db2 mirror for i
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a wor...
|
4.7 Medium | — | 0,07% | 4 Sep 2026 |
|
CVE-2022-35499
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.
|
7.1 High | — | 0,29% | 4 Sep 2026 |
|
CVE-2022-35497
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting a...
|
5.4 Medium | — | 0,26% | 4 Sep 2026 |
|
CVE-2026-9186
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1...
|
6.5 Medium | — | 0,38% | 4 Sep 2026 |
|
CVE-2026-9138
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveTo...
|
6.5 Medium | — | 0,45% | 4 Sep 2026 |
|
CVE-2026-85700
Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attacker...
|
6.5 Medium | — | 0,51% | 4 Sep 2026 |
|
CVE-2026-8447
langflow
IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.
|
6.1 Medium | — | 0,30% | 4 Sep 2026 |
|
CVE-2026-85699
jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirec...
|
7.5 High | — | 0,48% | 4 Sep 2026 |
|
CVE-2026-85698
Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds vali...
|
5.5 Medium | — | 0,17% | 4 Sep 2026 |
|
CVE-2026-85697
Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges c...
|
6.5 Medium | — | 0,42% | 4 Sep 2026 |
|
CVE-2026-85696
SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper e...
|
9.8 Critical | — | 2,6% | 4 Sep 2026 |
|
CVE-2026-85695
FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and...
|
9.4 Critical | — | 0,72% | 4 Sep 2026 |
|
CVE-2026-85694
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from...
|
8.1 High | — | 0,94% | 4 Sep 2026 |
|
CVE-2026-85693
Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other...
|
6.5 Medium | — | 0,44% | 4 Sep 2026 |
|
CVE-2026-85692
Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/to...
|
6.5 Medium | — | 0,44% | 4 Sep 2026 |
|
CVE-2026-85691
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attacke...
|
7.5 High | — | 0,59% | 4 Sep 2026 |
|
CVE-2026-85690
Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers can influen...
|
7.8 High | — | 0,20% | 4 Sep 2026 |
|
CVE-2026-85689
llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/resources.py) where filter and lookup values are directly string-interpola...
|
6.5 Medium | — | 0,42% | 4 Sep 2026 |
|
CVE-2026-85688
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST an...
|
9.8 Critical | — | 2,6% | 4 Sep 2026 |
|
CVE-2026-85687
surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters...
|
7.5 High | — | 0,51% | 4 Sep 2026 |
|
CVE-2026-85686
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or red...
|
7.5 High | — | 0,48% | 4 Sep 2026 |
|
CVE-2026-85685
AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via a...
|
7.5 High | — | 0,55% | 4 Sep 2026 |
|
CVE-2026-85684
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated att...
|
9.1 Critical | — | 1,1% | 4 Sep 2026 |
|
CVE-2026-85676
Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Atta...
|
4.3 Medium | — | 0,42% | 4 Sep 2026 |
|
CVE-2026-85675
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs with no scheme...
|
7.5 High | — | 0,48% | 4 Sep 2026 |
|
CVE-2026-85674
aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (...
|
7.8 High | — | 0,25% | 4 Sep 2026 |
|
CVE-2026-85673
LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypa...
|
7.5 High | — | 0,51% | 4 Sep 2026 |
|
CVE-2026-85672
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated u...
|
9.8 Critical | — | 2,6% | 4 Sep 2026 |