Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-109556
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a calle...
|
8.0 High | — | 0,51% | 12 Okt 2026 |
|
CVE-2026-109427
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by for...
|
6.5 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109426
Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the opera...
|
7.5 High | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-109380
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal()....
|
7.5 High | — | 0,45% | 12 Okt 2026 |
|
CVE-2026-109379
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in...
|
5.3 Medium | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-109378
SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating...
|
4.3 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-109377
ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attac...
|
4.3 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-109376
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Times...
|
4.3 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-109375
Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by...
|
6.1 Medium | — | 0,32% | 12 Okt 2026 |
|
CVE-2026-108931
A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cgi of the component DHCP Handler. The manipulation...
|
4.3 Medium | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-108930
A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DD...
|
2.7 Low | — | 0,28% | 12 Okt 2026 |
|
CVE-2026-108929
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipula...
|
9.9 Critical | — | 0,43% | 12 Okt 2026 |
|
CVE-2026-108928
A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipu...
|
6.3 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-108927
A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulat...
|
6.3 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-106495
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend...
|
4.3 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-105052
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted...
|
7.5 High | — | 0,62% | 12 Okt 2026 |
|
CVE-2025-71429
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output f...
|
9.8 Critical | — | 2,9% | 12 Okt 2026 |
|
CVE-2024-58389
HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated...
|
6.1 Medium | — | 0,28% | 12 Okt 2026 |
|
CVE-2022-51020
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers ca...
|
5.9 Medium | — | 0,14% | 12 Okt 2026 |
|
CVE-2021-48012
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor...
|
8.2 High | — | 0,41% | 12 Okt 2026 |
|
CVE-2021-48011
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segme...
|
7.5 High | — | 0,56% | 12 Okt 2026 |
|
CVE-2020-37280
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote at...
|
7.5 High | — | 0,54% | 12 Okt 2026 |
|
CVE-2020-37279
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source...
|
8.1 High | — | 1,5% | 12 Okt 2026 |
|
CVE-2026-96012
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authoriza...
|
9.9 Critical | — | 0,51% | 12 Okt 2026 |
|
CVE-2026-95838
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain...
|
4.6 Medium | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-95837
containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores...
|
7.8 High | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-41510
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in i...
|
7.2 High | — | 0,50% | 12 Okt 2026 |
|
CVE-2026-109575
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improper...
|
9.8 Critical | — | 0,36% | 12 Okt 2026 |
|
CVE-2026-109425
Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural V...
|
5.3 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-109424
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response b...
|
5.9 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-109423
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjace...
|
7.4 High | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-109422
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridg...
|
8.1 High | — | 0,52% | 12 Okt 2026 |
|
CVE-2026-108926
A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of...
|
6.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-108924
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php o...
|
4.3 Medium | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-108923
A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of...
|
6.3 Medium | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-108362
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys at...
|
9.1 Critical | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-108361
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify...
|
7.2 High | — | 0,08% | 12 Okt 2026 |
|
CVE-2026-104774
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js...
|
5.8 Medium | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-104364
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.
|
3.3 Low | — | 0,09% | 12 Okt 2026 |
|
CVE-2026-104332
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table
|
5.5 Medium | — | 0,10% | 12 Okt 2026 |
|
CVE-2025-27902
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerabi...
|
6.1 Medium | — | 0,18% | 12 Okt 2026 |
|
CVE-2025-27897
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitra...
|
6.1 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2025-27896
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitra...
|
6.1 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2025-27895
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitra...
|
6.1 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-89140
Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespa...
|
6.0 Medium | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-87744
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer cu...
|
9.1 Critical | — | 0,29% | 12 Okt 2026 |
|
CVE-2026-85471
A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery...
|
6.4 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-83536
A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vul...
|
5.3 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-83535
A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authe...
|
7.4 High | — | 0,28% | 12 Okt 2026 |
|
CVE-2026-78404
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.
|
6.5 Medium | — | 0,13% | 12 Okt 2026 |