Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-108934
A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTT...
|
2.4 Low | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-108933
A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to cross site scripting....
|
2.4 Low | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-108932
A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the component DHCP Hostname Handler. This...
|
4.3 Medium | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-104140
QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Fea...
|
6.1 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-103658
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in...
|
5.9 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-102596
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true,...
|
4.3 Medium | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-102539
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption...
|
5.7 Medium | — | 0,13% | 12 Okt 2026 |
|
CVE-2026-97691
Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled...
|
4.3 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96266
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level...
|
8.2 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96265
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-l...
|
8.2 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96264
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-...
|
8.2 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96263
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware b...
|
8.2 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96262
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-l...
|
8.2 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96261
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level...
|
7.3 High | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-84360
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message...
|
8.1 High | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-84321
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but Delet...
|
5.4 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-84320
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-co...
|
6.3 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-84319
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_...
|
8.3 High | — | 0,28% | 12 Okt 2026 |
|
CVE-2026-84318
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and trigger...
|
8.8 High | — | 0,62% | 12 Okt 2026 |
|
CVE-2026-84317
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous...
|
8.8 High | — | 0,38% | 12 Okt 2026 |
|
CVE-2026-84316
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first direc...
|
8.8 High | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-84315
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even tho...
|
8.3 High | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-84314
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change anothe...
|
8.7 High | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-84313
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecure...
|
8.8 High | — | 0,43% | 12 Okt 2026 |
|
CVE-2026-78673
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.
|
7.5 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-75881
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when proce...
|
7.5 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-53997
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/cr...
|
7.4 High | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-41508
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart...
|
5.8 Medium | — | 0,49% | 12 Okt 2026 |
|
CVE-2026-41504
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats....
|
5.8 Medium | — | 0,39% | 12 Okt 2026 |
|
CVE-2026-18537
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image refe...
|
8.7 High | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-18533
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image conf...
|
6.5 Medium | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-18529
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled...
|
8.7 High | — | 0,67% | 12 Okt 2026 |
|
CVE-2026-18517
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to u...
|
7.7 High | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-18513
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definit...
|
7.2 High | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-16678
IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote authenticated attacker to cause...
|
4.5 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109571
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measu...
|
4.3 Medium | — | 0,18% | 12 Okt 2026 |
|
CVE-2026-109570
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to...
|
4.3 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-109569
sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches witho...
|
8.8 High | — | 0,13% | 12 Okt 2026 |
|
CVE-2026-109568
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated...
|
7.1 High | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-109567
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users per...
|
7.2 High | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-109566
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an Au...
|
9.8 Critical | — | 0,44% | 12 Okt 2026 |
|
CVE-2026-109565
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered...
|
6.1 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109564
LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced b...
|
3.1 Low | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-109563
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attacker...
|
7.5 High | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-109562
SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /ap...
|
5.4 Medium | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-109561
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted re...
|
4.2 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-109560
Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed...
|
7.5 High | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-109559
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matchin...
|
8.7 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-109558
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerous...
|
8.7 High | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-109557
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo...
|
8.7 High | — | 0,33% | 12 Okt 2026 |