Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-109341
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving...
|
7.1 High | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-109340
SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE...
|
5.4 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-109339
SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configu...
|
4.9 Medium | — | 0,38% | 12 Okt 2026 |
|
CVE-2026-109338
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaS...
|
6.5 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-109337
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE S...
|
4.3 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-109336
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT...
|
4.3 Medium | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-109335
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions throug...
|
6.5 Medium | — | 0,30% | 12 Okt 2026 |
|
CVE-2026-109334
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allow...
|
8.1 High | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-109333
SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases b...
|
6.5 Medium | — | 0,29% | 12 Okt 2026 |
|
CVE-2026-109332
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins i...
|
3.1 Low | — | 0,12% | 12 Okt 2026 |
|
CVE-2026-109331
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against th...
|
7.4 High | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-109330
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because...
|
4.3 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-109329
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other orga...
|
6.5 Medium | — | 0,29% | 12 Okt 2026 |
|
CVE-2026-109328
Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME registrat...
|
6.1 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109327
Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers...
|
6.1 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109326
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unau...
|
7.5 High | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-109325
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers...
|
7.5 High | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-109324
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. At...
|
6.5 Medium | — | 0,32% | 12 Okt 2026 |
|
CVE-2026-109323
Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and...
|
5.3 Medium | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-109322
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and me...
|
6.1 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109321
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsal...
|
9.1 Critical | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-109320
The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because Sessio...
|
5.4 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-109319
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and appro...
|
4.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109318
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitu...
|
8.8 High | — | 1,2% | 12 Okt 2026 |
|
CVE-2026-109317
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scal...
|
7.2 High | — | 0,36% | 12 Okt 2026 |
|
CVE-2026-109316
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the clas...
|
6.5 Medium | — | 0,27% | 12 Okt 2026 |
|
CVE-2026-109315
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction...
|
6.5 Medium | — | 0,30% | 12 Okt 2026 |
|
CVE-2026-109314
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the re...
|
7.3 High | — | 0,28% | 12 Okt 2026 |
|
CVE-2026-109313
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through...
|
8.1 High | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-109312
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end...
|
8.1 High | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-109311
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated rem...
|
6.5 Medium | — | 0,42% | 12 Okt 2026 |
|
CVE-2026-109310
SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish...
|
6.5 Medium | — | 0,32% | 12 Okt 2026 |
|
CVE-2026-109309
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseF...
|
6.5 Medium | — | 0,38% | 12 Okt 2026 |
|
CVE-2026-109308
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::...
|
8.8 High | — | 0,49% | 12 Okt 2026 |
|
CVE-2026-109307
Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled retur...
|
4.7 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-109306
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user chan...
|
5.9 Medium | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-109305
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators....
|
8.8 High | — | 0,49% | 12 Okt 2026 |
|
CVE-2026-109304
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument....
|
4.9 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-109303
Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries us...
|
4.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109302
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to op...
|
3.7 Low | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-109301
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, cau...
|
5.9 Medium | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-109300
Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as...
|
4.6 Medium | — | 0,18% | 12 Okt 2026 |
|
CVE-2026-109299
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submit...
|
6.5 Medium | — | 0,38% | 12 Okt 2026 |
|
CVE-2026-109298
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition...
|
6.5 Medium | — | 0,39% | 12 Okt 2026 |
|
CVE-2026-109297
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text m...
|
6.5 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-109296
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit...
|
4.3 Medium | — | 0,27% | 12 Okt 2026 |
|
CVE-2026-109295
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search...
|
6.5 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-109294
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying com...
|
6.5 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-109293
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool...
|
6.5 Medium | — | 0,29% | 12 Okt 2026 |
|
CVE-2026-109292
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full...
|
6.8 Medium | — | 0,32% | 12 Okt 2026 |