Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-110104
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores...
|
5.9 Medium | — | 0,28% | 13 Okt 2026 |
|
CVE-2026-110103
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Ty...
|
5.4 Medium | — | 0,23% | 13 Okt 2026 |
|
CVE-2026-110102
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips...
|
7.5 High | — | 0,12% | 13 Okt 2026 |
|
CVE-2026-110101
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME...
|
5.4 Medium | — | 0,22% | 13 Okt 2026 |
|
CVE-2026-110100
Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an...
|
5.4 Medium | — | 0,22% | 13 Okt 2026 |
|
CVE-2026-110099
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authentic...
|
4.3 Medium | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-110098
Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by au...
|
5.4 Medium | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-110097
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp...
|
8.1 High | — | 0,42% | 13 Okt 2026 |
|
CVE-2026-10759
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient inp...
|
5.5 Medium | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-109898
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af...
|
5.3 Medium | — | 0,18% | 13 Okt 2026 |
|
CVE-2026-109896
Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Co...
|
4.3 Medium | — | 0,16% | 13 Okt 2026 |
|
CVE-2026-109890
Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security...
|
5.3 Medium | — | 0,19% | 13 Okt 2026 |
|
CVE-2026-109828
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Perfor...
|
4.3 Medium | — | 0,39% | 13 Okt 2026 |
|
CVE-2026-109827
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Pa...
|
6.3 Medium | — | 0,29% | 13 Okt 2026 |
|
CVE-2026-109620
A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such...
|
7.3 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-109607
A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login End...
|
7.3 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-109606
A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the com...
|
7.3 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-109412
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
|
9.9 Critical | — | 0,87% | 13 Okt 2026 |
|
CVE-2026-106047
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary fil...
|
7.7 High | — | 0,73% | 13 Okt 2026 |
|
CVE-2026-106043
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted...
|
7.5 High | — | 0,66% | 13 Okt 2026 |
|
CVE-2026-106042
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated...
|
9.9 Critical | — | 0,79% | 13 Okt 2026 |
|
CVE-2026-106035
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQ...
|
5.5 Medium | — | 0,31% | 13 Okt 2026 |
|
CVE-2026-106034
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file sys...
|
5.0 Medium | — | 0,47% | 13 Okt 2026 |
|
CVE-2026-104250
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior t...
|
6.1 Medium | — | 0,19% | 13 Okt 2026 |
|
CVE-2026-104126
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering ca...
|
6.0 Medium | — | 0,38% | 13 Okt 2026 |
|
CVE-2026-103030
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOpti...
|
7.5 High | — | 0,36% | 13 Okt 2026 |
|
CVE-2026-102989
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-co...
|
9.3 Critical | — | 0,52% | 13 Okt 2026 |
|
CVE-2026-96299
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by cra...
|
6.5 Medium | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-96297
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggrega...
|
6.5 Medium | — | 0,22% | 13 Okt 2026 |
|
CVE-2026-81507
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option pr...
|
6.5 Medium | — | 0,26% | 13 Okt 2026 |
|
CVE-2026-78802
An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.
|
9.8 Critical | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-69150
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry...
|
4.3 Medium | — | 0,16% | 13 Okt 2026 |
|
CVE-2026-55695
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Gi...
|
9.1 Critical | — | 0,46% | 13 Okt 2026 |
|
CVE-2026-55675
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr...
|
10.0 Critical | — | 0,43% | 13 Okt 2026 |
|
CVE-2026-55376
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workf...
|
8.8 High | — | 0,36% | 13 Okt 2026 |
|
CVE-2026-54700
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte len...
|
6.9 Medium | — | 0,37% | 13 Okt 2026 |
|
CVE-2026-54697
ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length oct...
|
6.7 Medium | — | 0,13% | 13 Okt 2026 |
|
CVE-2026-49265
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/au...
|
6.8 Medium | — | 0,38% | 13 Okt 2026 |
|
CVE-2026-49264
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoin...
|
6.1 Medium | — | 0,31% | 13 Okt 2026 |
|
CVE-2026-110025
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of t...
|
7.3 High | — | 0,38% | 13 Okt 2026 |
|
CVE-2026-109605
A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of th...
|
7.3 High | — | 0,47% | 13 Okt 2026 |
|
CVE-2026-109526
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to inf...
|
3.3 Low | — | 0,14% | 13 Okt 2026 |
|
CVE-2026-109525
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file c...
|
7.3 High | — | 0,29% | 13 Okt 2026 |
|
CVE-2026-109524
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown fun...
|
5.3 Medium | — | 0,51% | 13 Okt 2026 |
|
CVE-2026-105460
A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A malicious...
|
5.5 Medium | — | 0,12% | 13 Okt 2026 |
|
CVE-2026-104935
ivanti connect secure
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version...
|
8.6 High | KEV | 26,0% | 13 Okt 2026 |
|
CVE-2026-104005
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by cra...
|
6.5 Medium | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-104004
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop...
|
6.5 Medium | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-103965
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions,...
|
5.4 Medium | — | 0,15% | 13 Okt 2026 |
|
CVE-2026-103928
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2...
|
9.3 Critical | — | 0,41% | 13 Okt 2026 |