Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-102603
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password)...
|
5.3 Medium | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-102342
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain...
|
5.4 Medium | — | 0,36% | 13 Okt 2026 |
|
CVE-2026-102250
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firm...
|
8.6 High | — | 0,15% | 13 Okt 2026 |
|
CVE-2024-34319
A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintende...
|
6.5 Medium | — | 0,20% | 13 Okt 2026 |
|
CVE-2026-95680
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
|
8.0 High | — | 0,18% | 13 Okt 2026 |
|
CVE-2026-93907
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
|
8.1 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-93347
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unval...
|
4.9 Medium | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-93346
Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent...
|
5.3 Medium | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-77362
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control l...
|
4.3 Medium | — | 0,20% | 13 Okt 2026 |
|
CVE-2026-77361
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relati...
|
4.7 Medium | — | 0,11% | 13 Okt 2026 |
|
CVE-2026-74047
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enro...
|
6.5 Medium | — | 0,26% | 13 Okt 2026 |
|
CVE-2026-74045
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled a...
|
7.1 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-74043
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster worker...
|
9.0 Critical | — | 0,36% | 13 Okt 2026 |
|
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authentic...
|
9.1 Critical | — | 0,37% | 13 Okt 2026 |
|
CVE-2026-74040
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrit...
|
9.1 Critical | — | 0,55% | 13 Okt 2026 |
|
CVE-2026-74037
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revo...
|
7.2 High | — | 0,39% | 13 Okt 2026 |
|
CVE-2026-74036
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attacker...
|
7.2 High | — | 0,83% | 13 Okt 2026 |
|
CVE-2026-74035
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy insid...
|
7.2 High | — | 0,50% | 13 Okt 2026 |
|
CVE-2026-74034
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled f...
|
7.5 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-74033
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers...
|
6.1 Medium | — | 0,23% | 13 Okt 2026 |
|
CVE-2026-74032
Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotec...
|
4.3 Medium | — | 0,26% | 13 Okt 2026 |
|
CVE-2026-74031
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to de...
|
6.5 Medium | — | 0,51% | 13 Okt 2026 |
|
CVE-2026-74030
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memo...
|
4.9 Medium | — | 0,40% | 13 Okt 2026 |
|
CVE-2026-109967
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash...
|
7.5 High | — | 0,56% | 13 Okt 2026 |
|
CVE-2026-109966
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixe...
|
5.3 Medium | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-109965
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repo...
|
7.1 High | — | 0,22% | 13 Okt 2026 |
|
CVE-2026-109964
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic ove...
|
5.6 Medium | — | 0,36% | 13 Okt 2026 |
|
CVE-2026-109963
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by ma...
|
4.3 Medium | — | 0,20% | 13 Okt 2026 |
|
CVE-2026-109962
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration v...
|
4.3 Medium | — | 0,20% | 13 Okt 2026 |
|
CVE-2026-109961
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group data...
|
8.5 High | — | 0,22% | 13 Okt 2026 |
|
CVE-2026-109960
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious...
|
7.7 High | — | 0,29% | 13 Okt 2026 |
|
CVE-2026-109959
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fe...
|
4.3 Medium | — | 0,22% | 13 Okt 2026 |
|
CVE-2026-109958
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book...
|
4.3 Medium | — | 0,22% | 13 Okt 2026 |
|
CVE-2026-109957
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments...
|
4.3 Medium | — | 0,20% | 13 Okt 2026 |
|
CVE-2026-109956
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model path...
|
7.0 High | — | 0,32% | 13 Okt 2026 |
|
CVE-2026-109955
Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting do...
|
5.3 Medium | — | 0,31% | 13 Okt 2026 |
|
CVE-2026-109954
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch req...
|
6.5 Medium | — | 0,22% | 13 Okt 2026 |
|
CVE-2026-109953
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegat...
|
5.3 Medium | — | 0,22% | 13 Okt 2026 |
|
CVE-2026-109952
The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation...
|
5.3 Medium | — | 0,26% | 13 Okt 2026 |
|
CVE-2026-109951
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malic...
|
5.3 Medium | — | 0,30% | 13 Okt 2026 |
|
CVE-2026-109950
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message length...
|
4.3 Medium | — | 0,28% | 13 Okt 2026 |
|
CVE-2026-109949
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry...
|
6.5 Medium | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-109948
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client mem...
|
4.3 Medium | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-109947
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized driv...
|
6.5 Medium | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-109946
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts t...
|
6.5 Medium | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-109945
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently...
|
5.3 Medium | — | 0,23% | 13 Okt 2026 |
|
CVE-2026-109944
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up...
|
6.5 Medium | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-109943
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array...
|
6.5 Medium | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-109942
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-on...
|
6.5 Medium | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-109941
FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chu...
|
6.5 Medium | — | 0,27% | 13 Okt 2026 |