Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-109241
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending...
|
3.1 Low | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-109240
FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated...
|
3.1 Low | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-109239
Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress...
|
5.3 Medium | — | 0,27% | 12 Okt 2026 |
|
CVE-2026-109238
Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /c...
|
8.6 High | — | 0,30% | 12 Okt 2026 |
|
CVE-2026-109237
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict...
|
8.1 High | — | 0,32% | 12 Okt 2026 |
|
CVE-2026-108914
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argume...
|
9.9 Critical | — | 0,57% | 12 Okt 2026 |
|
CVE-2026-108909
A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipula...
|
4.3 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-108908
A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the comp...
|
2.4 Low | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-108907
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authenticat...
|
10.0 Critical | — | 1,2% | 12 Okt 2026 |
|
CVE-2026-108478
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite al...
|
6.5 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-108477
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: fr...
|
5.3 Medium | — | 0,18% | 12 Okt 2026 |
|
CVE-2026-108476
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Leve...
|
5.0 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-108475
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Contr...
|
4.3 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-105274
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's A...
|
2.1 Low | — | 0,42% | 12 Okt 2026 |
|
CVE-2026-9191
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDB...
|
9.6 Critical | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-96618
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the...
|
2.1 Low | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-96612
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outsi...
|
7.5 High | — | 0,40% | 12 Okt 2026 |
|
CVE-2026-92682
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when tr...
|
8.6 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-92681
In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for to...
|
9.3 Critical | — | 0,37% | 12 Okt 2026 |
|
CVE-2026-85956
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform...
|
9.6 Critical | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-85955
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation f...
|
9.9 Critical | — | 0,45% | 12 Okt 2026 |
|
CVE-2026-85954
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery function...
|
8.6 High | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-85953
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-...
|
8.5 High | — | 0,30% | 12 Okt 2026 |
|
CVE-2026-85952
Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could...
|
8.5 High | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-85951
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an aut...
|
8.5 High | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-85950
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative...
|
8.4 High | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-85949
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configura...
|
8.1 High | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-85948
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remo...
|
9.9 Critical | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-85947
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote atta...
|
9.9 Critical | — | 0,35% | 12 Okt 2026 |
|
CVE-2026-81856
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject ter...
|
2.3 Low | — | 0,37% | 12 Okt 2026 |
|
CVE-2026-109399
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embe...
|
8.1 High | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109398
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreate...
|
7.5 High | — | 0,45% | 12 Okt 2026 |
|
CVE-2026-109397
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending...
|
7.2 High | — | 0,44% | 12 Okt 2026 |
|
CVE-2026-109396
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying...
|
4.2 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-109394
Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset register...
|
7.4 High | — | 0,34% | 12 Okt 2026 |
|
CVE-2026-109393
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, Ad...
|
6.3 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109392
Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in Exter...
|
5.4 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-109391
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/...
|
8.1 High | — | 0,48% | 12 Okt 2026 |
|
CVE-2026-109195
A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure....
|
3.1 Low | — | 0,15% | 12 Okt 2026 |
|
CVE-2026-109194
A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specifie...
|
6.4 Medium | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-108906
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulatio...
|
7.2 High | — | 0,43% | 12 Okt 2026 |
|
CVE-2026-108901
A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rend...
|
3.5 Low | — | 0,27% | 12 Okt 2026 |
|
CVE-2026-108900
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation le...
|
7.3 High | — | 0,39% | 12 Okt 2026 |
|
CVE-2026-108899
A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Except...
|
7.3 High | — | 0,58% | 12 Okt 2026 |
|
CVE-2026-105668
Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published rel...
|
7.1 High | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-105280
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --out...
|
6.9 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-103503
Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA i...
|
5.9 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory o...
|
7.5 High | — | 0,37% | 12 Okt 2026 |
|
CVE-2026-92877
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that fea...
|
8.3 High | — | 0,27% | 12 Okt 2026 |
|
CVE-2026-109390
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as...
|
9.8 Critical | — | 1,6% | 12 Okt 2026 |