Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-104774
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js...
|
5.8 Medium | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-104364
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.
|
3.3 Low | — | 0,09% | 12 Okt 2026 |
|
CVE-2026-104332
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table
|
5.5 Medium | — | 0,10% | 12 Okt 2026 |
|
CVE-2025-27902
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerabi...
|
6.1 Medium | — | 0,18% | 12 Okt 2026 |
|
CVE-2025-27897
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitra...
|
6.1 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2025-27896
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitra...
|
6.1 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2025-27895
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitra...
|
6.1 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-89140
Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespa...
|
6.0 Medium | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-87744
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer cu...
|
9.1 Critical | — | 0,29% | 12 Okt 2026 |
|
CVE-2026-85471
A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery...
|
6.4 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-83536
A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vul...
|
5.3 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-83535
A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authe...
|
7.4 High | — | 0,28% | 12 Okt 2026 |
|
CVE-2026-78404
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.
|
6.5 Medium | — | 0,13% | 12 Okt 2026 |
|
CVE-2026-65954
PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActual...
|
8.6 High | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-59977
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenti...
|
8.1 High | — | 0,15% | 12 Okt 2026 |
|
CVE-2026-59976
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an...
|
8.1 High | — | 0,65% | 12 Okt 2026 |
|
CVE-2026-57143
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter...
|
8.8 High | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-57118
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}...
|
9.8 Critical | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-18166
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain s...
|
7.7 High | — | 0,42% | 12 Okt 2026 |
|
CVE-2026-108922
A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_...
|
6.3 Medium | — | 0,27% | 12 Okt 2026 |
|
CVE-2026-108921
A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file...
|
7.3 High | — | 0,66% | 12 Okt 2026 |
|
CVE-2026-108920
A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user_record.php of the com...
|
4.3 Medium | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-108919
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php of the compo...
|
4.3 Medium | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-107226
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default...
|
6.8 Medium | — | 0,36% | 12 Okt 2026 |
|
CVE-2026-105466
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.
|
6.5 Medium | — | 0,41% | 12 Okt 2026 |
|
CVE-2026-105465
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.
|
8.8 High | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-105464
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privilege...
|
8.8 High | — | 0,09% | 12 Okt 2026 |
|
CVE-2026-104355
A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound n...
|
7.0 High | — | 0,36% | 12 Okt 2026 |
|
CVE-2026-104102
copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explici...
|
5.3 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-103061
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete a director...
|
5.9 Medium | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-102663
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison a...
|
4.3 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-77366
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault...
|
9.9 Critical | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-77364
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, str...
|
6.5 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-77363
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Orig...
|
8.8 High | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-6232
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length...
|
5.2 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-61994
Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Memb...
|
5.4 Medium | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-42689
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race...
|
3.7 Low | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-109448
Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt...
|
5.9 Medium | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-108918
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to...
|
10.0 Critical | — | 2,0% | 12 Okt 2026 |
|
CVE-2026-108917
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the...
|
10.0 Critical | — | 2,0% | 12 Okt 2026 |
|
CVE-2026-108916
A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument subm...
|
8.3 High | — | 1,7% | 12 Okt 2026 |
|
CVE-2026-108915
A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buf...
|
9.9 Critical | — | 0,45% | 12 Okt 2026 |
|
CVE-2026-108486
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminato...
|
5.3 Medium | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-108482
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor a...
|
6.5 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-108481
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from...
|
7.4 High | — | 0,12% | 12 Okt 2026 |
|
CVE-2026-108479
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from...
|
8.1 High | — | 0,13% | 12 Okt 2026 |
|
CVE-2026-107862
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based...
|
6.5 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-107418
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: fr...
|
5.4 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-103080
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a...
|
5.3 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-94451
Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the so...
|
6.5 Medium | — | 0,23% | 12 Okt 2026 |