Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-102189
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-102188
Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
|
6.8 Medium | — | 0,42% | 13 Okt 2026 |
|
CVE-2026-102187
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
|
5.5 Medium | — | 0,40% | 13 Okt 2026 |
|
CVE-2026-102186
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
|
4.7 Medium | — | 0,32% | 13 Okt 2026 |
|
CVE-2026-100225
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-100222
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 0,96% | 13 Okt 2026 |
|
CVE-2026-100220
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,84% | 13 Okt 2026 |
|
CVE-2026-100219
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 1,00% | 13 Okt 2026 |
|
CVE-2026-100218
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
|
8.1 High | — | 0,72% | 13 Okt 2026 |
|
CVE-2026-100217
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,28% | 13 Okt 2026 |
|
CVE-2026-100216
Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-100215
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
|
7.8 High | — | 0,48% | 13 Okt 2026 |
|
CVE-2026-100214
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
|
8.8 High | — | 1,8% | 13 Okt 2026 |
|
CVE-2026-100212
microsoft 365 apps, microsoft 365 +3 lainnya
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,80% | 13 Okt 2026 |
|
CVE-2026-100211
microsoft 365 apps, microsoft 365 +2 lainnya
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,84% | 13 Okt 2026 |
|
CVE-2026-100210
microsoft 365 apps, microsoft 365 +3 lainnya
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,84% | 13 Okt 2026 |
|
CVE-2026-100209
microsoft 365 apps, microsoft 365 +2 lainnya
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,84% | 13 Okt 2026 |
|
CVE-2026-100207
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
|
7.3 High | — | 0,42% | 13 Okt 2026 |
|
CVE-2026-100205
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
|
7.1 High | — | 0,35% | 13 Okt 2026 |
|
CVE-2026-100203
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-100202
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 1,00% | 13 Okt 2026 |
|
CVE-2026-100201
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-100200
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-100133
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form field...
|
9.3 Critical | — | 0,94% | 13 Okt 2026 |
|
CVE-2026-95502
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled...
|
5.3 Medium | — | 0,37% | 13 Okt 2026 |
|
CVE-2026-93294
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's...
|
6.3 Medium | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-92892
Potential arbitrary code execution, under specific configurations.
|
9.0 Critical | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-52394
DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.
|
9.1 Critical | — | 0,40% | 13 Okt 2026 |
|
CVE-2026-37107
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component
|
9.8 Critical | — | 0,38% | 13 Okt 2026 |
|
CVE-2026-33374
The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can cras...
|
6.5 Medium | — | 0,37% | 13 Okt 2026 |
|
CVE-2026-23707
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4...
|
7.2 High | — | 0,31% | 13 Okt 2026 |
|
CVE-2026-23706
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4...
|
6.5 Medium | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-23705
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4...
|
7.2 High | — | 0,31% | 13 Okt 2026 |
|
CVE-2026-15577
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect a...
|
6.5 Medium | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-108385
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0...
|
8.8 High | — | 0,37% | 13 Okt 2026 |
|
CVE-2026-108384
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0...
|
8.8 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-108383
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0...
|
8.8 High | — | 0,29% | 13 Okt 2026 |
|
CVE-2026-108382
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0...
|
8.8 High | — | 0,37% | 13 Okt 2026 |
|
CVE-2026-108381
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0...
|
8.8 High | — | 0,30% | 13 Okt 2026 |
|
CVE-2026-108380
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9...
|
8.8 High | — | 0,45% | 13 Okt 2026 |
|
CVE-2026-108379
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0...
|
8.8 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-108378
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0...
|
8.8 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-108377
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3...
|
8.8 High | — | 0,38% | 13 Okt 2026 |
|
CVE-2026-108376
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3...
|
8.8 High | — | 0,37% | 13 Okt 2026 |
|
CVE-2026-108375
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0...
|
8.8 High | — | 0,46% | 13 Okt 2026 |
|
CVE-2026-106176
A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests
|
3.8 Low | — | 0,21% | 13 Okt 2026 |
|
CVE-2026-106175
A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through...
|
2.3 Low | — | 0,10% | 13 Okt 2026 |
|
CVE-2026-106173
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code...
|
9.8 Critical | — | 0,43% | 13 Okt 2026 |
|
CVE-2026-106172
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSa...
|
5.3 Medium | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-106171
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6....
|
6.1 Medium | — | 0,71% | 13 Okt 2026 |