Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-76976
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an a...
|
5.4 Medium | — | 0,14% | 13 Okt 2026 |
|
CVE-2026-76975
Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authentica...
|
6.1 Medium | — | 0,17% | 13 Okt 2026 |
|
CVE-2026-76972
Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by t...
|
6.5 Medium | — | 0,16% | 13 Okt 2026 |
|
CVE-2026-58249
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated a...
|
7.5 High | — | 0,32% | 13 Okt 2026 |
|
CVE-2026-58242
SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requi...
|
3.5 Low | — | 0,16% | 13 Okt 2026 |
|
CVE-2026-108945
A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/au...
|
5.3 Medium | — | 0,14% | 13 Okt 2026 |
|
CVE-2026-108944
A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function get_obj_from_s...
|
4.8 Medium | — | 0,12% | 13 Okt 2026 |
|
CVE-2026-108943
A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.from_pretrained of the file lightx2v/models/runners/cosmos3/cosmos3...
|
5.3 Medium | — | 0,14% | 13 Okt 2026 |
|
CVE-2026-108942
A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the f...
|
3.5 Low | — | 0,20% | 13 Okt 2026 |
|
CVE-2026-96119
ibm i
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sani...
|
9.9 Critical | — | 0,51% | 13 Okt 2026 |
|
CVE-2026-93886
ibm i
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.
|
5.4 Medium | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-81858
ibm i
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Serv...
|
8.1 High | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-19938
The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every other error e...
|
5.9 Medium | — | 0,16% | 13 Okt 2026 |
|
CVE-2026-19937
The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_COUNT me...
|
5.7 Medium | — | 0,18% | 13 Okt 2026 |
|
CVE-2026-19936
The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_...
|
4.8 Medium | — | 0,14% | 13 Okt 2026 |
|
CVE-2026-18343
ibm i
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.
|
4.4 Medium | — | 0,12% | 13 Okt 2026 |
|
CVE-2026-18318
ibm i
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.
|
5.3 Medium | — | 0,28% | 13 Okt 2026 |
|
CVE-2026-17487
ibm i
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.
|
5.3 Medium | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-17484
ibm i
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.
|
5.5 Medium | — | 0,19% | 13 Okt 2026 |
|
CVE-2026-108941
A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parse_cfg_args of the file internal/utils/common.py of the component Sidecar...
|
4.8 Medium | — | 0,12% | 13 Okt 2026 |
|
CVE-2026-108940
A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs...
|
6.5 Medium | — | 0,59% | 13 Okt 2026 |
|
CVE-2026-108939
A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_global_ip of the file mistralrs-server-core/src/media_source.rs. Such m...
|
5.3 Medium | — | 0,48% | 13 Okt 2026 |
|
CVE-2026-93892
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the...
|
8.1 High | — | 0,28% | 12 Okt 2026 |
|
CVE-2026-93891
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injec...
|
7.6 High | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-92832
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.
|
5.1 Medium | — | 0,07% | 12 Okt 2026 |
|
CVE-2026-85457
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
|
8.1 High | — | 0,36% | 12 Okt 2026 |
|
CVE-2026-84418
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bear...
|
7.4 High | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-82110
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path tra...
|
9.9 Critical | — | 0,49% | 12 Okt 2026 |
|
CVE-2026-82108
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used...
|
8.8 High | — | 0,45% | 12 Okt 2026 |
|
CVE-2026-82103
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an...
|
6.5 Medium | — | 0,30% | 12 Okt 2026 |
|
CVE-2026-82101
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
|
9.6 Critical | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-82096
ibm datastage on cloud pak for data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements u...
|
8.8 High | — | 0,42% | 12 Okt 2026 |
|
CVE-2026-75782
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.
|
7.8 High | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-75621
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account.
|
6.2 Medium | — | 0,12% | 12 Okt 2026 |
|
CVE-2026-75095
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
|
7.5 High | — | 0,32% | 12 Okt 2026 |
|
CVE-2026-75076
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files.
|
4.3 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-75063
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.
|
5.4 Medium | — | 0,18% | 12 Okt 2026 |
|
CVE-2026-75061
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing...
|
7.5 High | — | 0,36% | 12 Okt 2026 |
|
CVE-2026-19627
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file...
|
8.2 High | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-19622
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
|
8.8 High | — | 0,36% | 12 Okt 2026 |
|
CVE-2026-19620
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.
|
8.8 High | — | 0,34% | 12 Okt 2026 |
|
CVE-2026-18541
IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in th...
|
6.4 Medium | — | 0,15% | 12 Okt 2026 |
|
CVE-2026-17475
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional lev...
|
7.1 High | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-109675
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows aut...
|
4.3 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-109674
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated at...
|
6.5 Medium | — | 0,34% | 12 Okt 2026 |
|
CVE-2026-109673
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutrali...
|
7.3 High | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109672
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization check...
|
6.5 Medium | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-109671
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into port...
|
7.3 High | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109670
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attack...
|
5.4 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-109669
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization chec...
|
4.3 Medium | — | 0,22% | 12 Okt 2026 |