Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-108898
A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID result...
|
3.5 Low | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-108897
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the function syncInvoke of the component...
|
5.3 Medium | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-108896
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd...
|
9.9 Critical | — | 2,2% | 12 Okt 2026 |
|
CVE-2026-108895
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argum...
|
9.9 Critical | — | 2,2% | 12 Okt 2026 |
|
CVE-2026-108094
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy...
|
7.8 High | — | 0,14% | 12 Okt 2026 |
|
CVE-2026-103526
In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauth...
|
3.7 Low | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-103522
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with admini...
|
7.2 High | — | 0,45% | 12 Okt 2026 |
|
CVE-2026-103521
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation....
|
7.2 High | — | 0,47% | 12 Okt 2026 |
|
CVE-2026-18390
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technol...
|
7.8 High | — | 0,49% | 12 Okt 2026 |
|
CVE-2026-12613
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministr...
|
8.8 High | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-109229
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None...
|
7.5 High | — | 0,42% | 12 Okt 2026 |
|
CVE-2026-109228
SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames,...
|
7.5 High | — | 0,49% | 12 Okt 2026 |
|
CVE-2026-109227
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applyin...
|
7.5 High | — | 0,42% | 12 Okt 2026 |
|
CVE-2026-109226
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed au...
|
7.5 High | — | 0,46% | 12 Okt 2026 |
|
CVE-2026-109225
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to...
|
7.5 High | — | 0,43% | 12 Okt 2026 |
|
CVE-2026-109206
LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the Avatar...
|
5.3 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-109205
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk wi...
|
7.5 High | — | 0,42% | 12 Okt 2026 |
|
CVE-2026-109204
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the r...
|
6.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109203
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted P...
|
6.5 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-109202
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted fol...
|
6.5 Medium | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-109201
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and mo...
|
8.3 High | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-109200
LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs wi...
|
6.4 Medium | — | 0,18% | 12 Okt 2026 |
|
CVE-2026-109199
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates i...
|
8.8 High | — | 0,39% | 12 Okt 2026 |
|
CVE-2026-109170
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unv...
|
6.5 Medium | — | 0,27% | 12 Okt 2026 |
|
CVE-2026-109169
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of Ta...
|
6.5 Medium | — | 0,27% | 12 Okt 2026 |
|
CVE-2026-108894
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route...
|
9.9 Critical | — | 2,2% | 12 Okt 2026 |
|
CVE-2026-108893
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument...
|
9.9 Critical | — | 0,53% | 12 Okt 2026 |
|
CVE-2026-108892
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Ma...
|
10.0 Critical | — | 0,62% | 12 Okt 2026 |
|
CVE-2026-108890
A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/se...
|
6.3 Medium | — | 0,50% | 12 Okt 2026 |
|
CVE-2026-103502
Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other rep...
|
5.9 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-93695
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enfo...
|
7.4 High | — | 0,17% | 12 Okt 2026 |
|
CVE-2026-93694
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior togeth...
|
4.0 Medium | — | 0,07% | 12 Okt 2026 |
|
CVE-2026-93693
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, a...
|
6.5 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-52903
A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in...
|
8.8 High | — | 0,45% | 12 Okt 2026 |
|
CVE-2026-109188
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpo...
|
4.3 Medium | — | 0,27% | 12 Okt 2026 |
|
CVE-2026-109187
jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey ha...
|
6.5 Medium | — | 0,25% | 12 Okt 2026 |
|
CVE-2026-109186
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including t...
|
8.8 High | — | 0,36% | 12 Okt 2026 |
|
CVE-2026-109185
jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to an...
|
8.8 High | — | 0,29% | 12 Okt 2026 |
|
CVE-2026-109184
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an ar...
|
4.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109183
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDep...
|
4.3 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109182
jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions e...
|
4.3 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109181
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by...
|
4.3 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-109180
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds...
|
4.3 Medium | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-109179
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privil...
|
4.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109178
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-p...
|
5.4 Medium | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-109177
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by...
|
4.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109176
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /n...
|
5.4 Medium | — | 0,22% | 12 Okt 2026 |
|
CVE-2026-109175
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files...
|
4.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109174
MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoi...
|
6.5 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-109173
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/cr...
|
4.3 Medium | — | 0,21% | 12 Okt 2026 |