Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2023-54406
Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when...
|
4.9 Medium | — | 0,32% | 12 Okt 2026 |
|
CVE-2026-92876
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
|
7.5 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-90921
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination o...
|
7.5 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-90920
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
|
9.8 Critical | — | 0,54% | 12 Okt 2026 |
|
CVE-2026-90912
IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
|
7.5 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-90911
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
|
7.5 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-84312
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and...
|
7.1 High | — | 0,18% | 12 Okt 2026 |
|
CVE-2026-54459
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creat...
|
4.3 Medium | — | 0,10% | 12 Okt 2026 |
|
CVE-2026-53922
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain tw...
|
6.5 Medium | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-49484
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Ob...
|
5.1 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-49483
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiCompone...
|
8.9 High | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-44828
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, o...
|
9.3 Critical | — | 0,36% | 12 Okt 2026 |
|
CVE-2026-41210
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious h...
|
6.5 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-108934
A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTT...
|
2.4 Low | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-108933
A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to cross site scripting....
|
2.4 Low | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-108932
A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the component DHCP Hostname Handler. This...
|
4.3 Medium | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-104140
QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Fea...
|
6.1 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-103658
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in...
|
5.9 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-102596
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true,...
|
4.3 Medium | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-102539
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption...
|
5.7 Medium | — | 0,13% | 12 Okt 2026 |
|
CVE-2026-97691
Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled...
|
4.3 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96266
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level...
|
8.2 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96265
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-l...
|
8.2 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96264
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-...
|
8.2 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96263
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware b...
|
8.2 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96262
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-l...
|
8.2 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-96261
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level...
|
7.3 High | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-84360
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message...
|
8.1 High | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-84321
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but Delet...
|
5.4 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-84320
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-co...
|
6.3 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-84319
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_...
|
8.3 High | — | 0,28% | 12 Okt 2026 |
|
CVE-2026-84318
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and trigger...
|
8.8 High | — | 0,62% | 12 Okt 2026 |
|
CVE-2026-84317
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous...
|
8.8 High | — | 0,38% | 12 Okt 2026 |
|
CVE-2026-84316
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first direc...
|
8.8 High | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-84315
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even tho...
|
8.3 High | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-84314
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change anothe...
|
8.7 High | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-84313
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecure...
|
8.8 High | — | 0,43% | 12 Okt 2026 |
|
CVE-2026-78673
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.
|
7.5 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-75881
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when proce...
|
7.5 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-53997
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/cr...
|
7.4 High | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-41508
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart...
|
5.8 Medium | — | 0,49% | 12 Okt 2026 |
|
CVE-2026-41504
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats....
|
5.8 Medium | — | 0,39% | 12 Okt 2026 |
|
CVE-2026-18537
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image refe...
|
8.7 High | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-18533
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image conf...
|
6.5 Medium | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-18529
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled...
|
8.7 High | — | 0,67% | 12 Okt 2026 |
|
CVE-2026-18517
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to u...
|
7.7 High | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-18513
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definit...
|
7.2 High | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-16678
IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote authenticated attacker to cause...
|
4.5 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109571
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measu...
|
4.3 Medium | — | 0,18% | 12 Okt 2026 |
|
CVE-2026-109570
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to...
|
4.3 Medium | — | 0,17% | 12 Okt 2026 |