Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-109569
sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches witho...
|
8.8 High | — | 0,13% | 12 Okt 2026 |
|
CVE-2026-109568
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated...
|
7.1 High | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-109567
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users per...
|
7.2 High | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-109566
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an Au...
|
9.8 Critical | — | 0,44% | 12 Okt 2026 |
|
CVE-2026-109565
Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered...
|
6.1 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109564
LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced b...
|
3.1 Low | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-109563
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attacker...
|
7.5 High | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-109562
SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /ap...
|
5.4 Medium | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-109561
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted re...
|
4.2 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-109560
Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed...
|
7.5 High | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-109559
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matchin...
|
8.7 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-109558
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerous...
|
8.7 High | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-109557
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo...
|
8.7 High | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-109556
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a calle...
|
8.0 High | — | 0,51% | 12 Okt 2026 |
|
CVE-2026-109427
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by for...
|
6.5 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109426
Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the opera...
|
7.5 High | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-109380
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal()....
|
7.5 High | — | 0,45% | 12 Okt 2026 |
|
CVE-2026-109379
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in...
|
5.3 Medium | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-109378
SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating...
|
4.3 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-109377
ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attac...
|
4.3 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-109376
ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Times...
|
4.3 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-109375
Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by...
|
6.1 Medium | — | 0,32% | 12 Okt 2026 |
|
CVE-2026-108931
A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cgi of the component DHCP Handler. The manipulation...
|
4.3 Medium | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-108930
A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DD...
|
2.7 Low | — | 0,28% | 12 Okt 2026 |
|
CVE-2026-108929
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipula...
|
9.9 Critical | — | 0,43% | 12 Okt 2026 |
|
CVE-2026-108928
A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipu...
|
6.3 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-108927
A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulat...
|
6.3 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-106495
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend...
|
4.3 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-105052
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted...
|
7.5 High | — | 0,62% | 12 Okt 2026 |
|
CVE-2025-71429
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output f...
|
9.8 Critical | — | 2,9% | 12 Okt 2026 |
|
CVE-2024-58389
HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated...
|
6.1 Medium | — | 0,28% | 12 Okt 2026 |
|
CVE-2022-51020
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers ca...
|
5.9 Medium | — | 0,14% | 12 Okt 2026 |
|
CVE-2021-48012
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor...
|
8.2 High | — | 0,41% | 12 Okt 2026 |
|
CVE-2021-48011
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segme...
|
7.5 High | — | 0,56% | 12 Okt 2026 |
|
CVE-2020-37280
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote at...
|
7.5 High | — | 0,54% | 12 Okt 2026 |
|
CVE-2020-37279
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source...
|
8.1 High | — | 1,5% | 12 Okt 2026 |
|
CVE-2026-96012
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authoriza...
|
9.9 Critical | — | 0,51% | 12 Okt 2026 |
|
CVE-2026-95838
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain...
|
4.6 Medium | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-95837
containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores...
|
7.8 High | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-41510
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in i...
|
7.2 High | — | 0,50% | 12 Okt 2026 |
|
CVE-2026-109575
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improper...
|
9.8 Critical | — | 0,36% | 12 Okt 2026 |
|
CVE-2026-109425
Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural V...
|
5.3 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-109424
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response b...
|
5.9 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-109423
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjace...
|
7.4 High | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-109422
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridg...
|
8.1 High | — | 0,52% | 12 Okt 2026 |
|
CVE-2026-108926
A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of...
|
6.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-108924
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php o...
|
4.3 Medium | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-108923
A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of...
|
6.3 Medium | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-108362
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys at...
|
9.1 Critical | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-108361
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify...
|
7.2 High | — | 0,08% | 12 Okt 2026 |