Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-102988
Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpac...
|
5.3 Medium | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-102982
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store...
|
8.5 High | — | 0,35% | 13 Okt 2026 |
|
CVE-2026-102981
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk...
|
6.5 Medium | — | 0,21% | 13 Okt 2026 |
|
CVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the mar...
|
4.2 Medium | — | 0,15% | 13 Okt 2026 |
|
CVE-2026-102734
asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a c...
|
5.5 Medium | — | 0,13% | 13 Okt 2026 |
|
CVE-2026-102672
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron application...
|
6.7 Medium | — | 0,11% | 13 Okt 2026 |
|
CVE-2026-101899
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname su...
|
6.9 Medium | — | 0,53% | 13 Okt 2026 |
|
CVE-2024-34324
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_Sessio...
|
9.1 Critical | — | 0,16% | 13 Okt 2026 |
|
CVE-2024-34323
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows att...
|
10.0 Critical | — | 0,36% | 13 Okt 2026 |
|
CVE-2024-34320
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
|
9.8 Critical | — | 0,16% | 13 Okt 2026 |
|
CVE-2026-97334
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance rele...
|
8.7 High | — | 0,36% | 13 Okt 2026 |
|
CVE-2026-97333
QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Co...
|
7.1 High | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-9218
Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network an...
|
4.5 Medium | — | 0,18% | 13 Okt 2026 |
|
CVE-2026-95121
An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an und...
|
7.8 High | — | 0,18% | 13 Okt 2026 |
|
CVE-2026-95115
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser
|
7.5 High | — | 0,29% | 13 Okt 2026 |
|
CVE-2026-95122
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service
|
7.5 High | — | 0,52% | 13 Okt 2026 |
|
CVE-2026-95114
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service
|
7.5 High | — | 0,52% | 13 Okt 2026 |
|
CVE-2026-77375
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, ca...
|
6.5 Medium | — | 0,31% | 13 Okt 2026 |
|
CVE-2026-77100
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault inst...
|
8.7 High | — | 0,32% | 13 Okt 2026 |
|
CVE-2026-77099
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
|
9.3 Critical | — | 0,39% | 13 Okt 2026 |
|
CVE-2026-77096
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
|
7.7 High | — | 0,23% | 13 Okt 2026 |
|
CVE-2026-77095
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations...
|
7.1 High | — | 0,23% | 13 Okt 2026 |
|
CVE-2026-77094
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved...
|
7.1 High | — | 0,23% | 13 Okt 2026 |
|
CVE-2026-77093
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, inclu...
|
7.1 High | — | 0,23% | 13 Okt 2026 |
|
CVE-2026-77090
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update...
|
8.7 High | — | 0,33% | 13 Okt 2026 |
|
CVE-2026-65200
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport librarie...
|
3.5 Low | — | 0,14% | 13 Okt 2026 |
|
CVE-2026-65199
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend...
|
5.4 Medium | — | 0,15% | 13 Okt 2026 |
|
CVE-2026-65198
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source...
|
8.6 High | — | 0,19% | 13 Okt 2026 |
|
CVE-2026-65197
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authen...
|
3.1 Low | — | 0,10% | 13 Okt 2026 |
|
CVE-2026-53711
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient...
|
5.1 Medium | — | 0,36% | 13 Okt 2026 |
|
CVE-2026-53709
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token...
|
9.8 Critical | — | 0,45% | 13 Okt 2026 |
|
CVE-2026-53420
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.
|
8.0 High | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-53418
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of p...
|
8.1 High | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-4869
A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an inse...
|
5.4 Medium | — | 0,11% | 13 Okt 2026 |
|
CVE-2026-18228
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation o...
|
7.1 High | — | 0,38% | 13 Okt 2026 |
|
CVE-2026-12656
A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interru...
|
8.7 High | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-12655
A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could r...
|
8.8 High | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-11732
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having...
|
8.8 High | — | 0,23% | 13 Okt 2026 |
|
CVE-2026-11731
An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management...
|
8.8 High | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-11730
Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to...
|
5.4 Medium | — | 0,16% | 13 Okt 2026 |
|
CVE-2026-109523
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown fu...
|
7.3 High | — | 0,26% | 13 Okt 2026 |
|
CVE-2026-109522
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the fil...
|
7.3 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-109521
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file...
|
7.3 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-108185
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.
|
7.4 High | — | 0,16% | 13 Okt 2026 |
|
CVE-2026-108184
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.
|
7.4 High | — | 0,16% | 13 Okt 2026 |
|
CVE-2026-107918
Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform...
|
4.5 Medium | — | 0,15% | 13 Okt 2026 |
|
CVE-2026-107917
Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perfo...
|
4.5 Medium | — | 0,15% | 13 Okt 2026 |
|
CVE-2026-106108
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPage...
|
5.7 Medium | — | 0,15% | 13 Okt 2026 |
|
CVE-2026-104192
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one stre...
|
9.6 Critical | — | 0,28% | 13 Okt 2026 |
|
CVE-2026-103028
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_...
|
4.3 Medium | — | 0,22% | 13 Okt 2026 |