Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-109172
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling...
|
4.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109171
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admi...
|
4.3 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-109168
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by s...
|
6.5 Medium | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-109167
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other u...
|
4.3 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-109166
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supp...
|
6.5 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-109165
TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/...
|
4.3 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-109164
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supply...
|
7.1 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-108953
mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into e...
|
7.8 High | — | 0,75% | 12 Okt 2026 |
|
CVE-2026-108952
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fi...
|
4.6 Medium | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-108951
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the A...
|
6.5 Medium | — | 0,30% | 12 Okt 2026 |
|
CVE-2026-108950
Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download...
|
5.3 Medium | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-108889
A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_14000443C in the library LWBilling64.sys of the compon...
|
4.4 Medium | — | 0,15% | 12 Okt 2026 |
|
CVE-2026-108836
A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipul...
|
7.3 High | — | 0,47% | 12 Okt 2026 |
|
CVE-2026-108835
A flaw has been found in Yungengxin Yun Jia Security Guard up to 2.7.1.9. Impacted is the function sub_14000885C in the library kgameprotect.sys. Executing a manipulation...
|
4.4 Medium | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-108834
A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handl...
|
4.3 Medium | — | 0,42% | 12 Okt 2026 |
|
CVE-2026-108831
A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component...
|
6.3 Medium | — | 0,26% | 12 Okt 2026 |
|
CVE-2026-105081
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configur...
|
3.6 Low | — | 0,11% | 12 Okt 2026 |
|
CVE-2026-108830
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. T...
|
4.2 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-108829
A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Co...
|
4.7 Medium | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-108828
A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. Th...
|
4.1 Medium | — | 0,28% | 12 Okt 2026 |
|
CVE-2026-108827
A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the component Admin...
|
4.1 Medium | — | 0,33% | 12 Okt 2026 |
|
CVE-2026-105283
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms...
|
6.3 Medium | — | 0,32% | 12 Okt 2026 |
|
CVE-2026-108826
A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp.php of the component PayPal I...
|
7.3 High | — | 0,41% | 12 Okt 2026 |
|
CVE-2026-108825
A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of...
|
5.4 Medium | — | 0,37% | 12 Okt 2026 |
|
CVE-2026-108824
A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulatio...
|
6.3 Medium | — | 0,37% | 12 Okt 2026 |
|
CVE-2026-105412
An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database.
|
7.1 High | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-105411
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administ...
|
8.1 High | — | 0,23% | 12 Okt 2026 |
|
CVE-2026-105410
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in u...
|
8.7 High | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-105409
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in u...
|
8.7 High | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-105408
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in u...
|
8.7 High | — | 0,20% | 12 Okt 2026 |
|
CVE-2026-105407
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server.
|
8.8 High | — | 1,8% | 12 Okt 2026 |
|
CVE-2026-103903
An incorrect authorization vulnerability in the WinBox
authentication flow of MikroTik RouterOS allows a remote authenticated attacker
with credentials for a low-privileg...
|
8.8 High | — | 0,42% | 12 Okt 2026 |
|
CVE-2026-103902
Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerabil...
|
7.5 High | — | 0,15% | 12 Okt 2026 |
|
CVE-2026-108822
A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isup_get_calling_party of the file src/modules/sipt/ss7_parser.c of the c...
|
5.3 Medium | — | 0,77% | 12 Okt 2026 |
|
CVE-2026-108821
A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component...
|
6.3 Medium | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-108820
A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function member_agent.run in the library libs/agno/agno/team/_default_tools.py o...
|
6.3 Medium | — | 0,27% | 12 Okt 2026 |
|
CVE-2026-108819
A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer. Performin...
|
7.3 High | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-1907
A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by s...
|
7.5 High | — | 0,13% | 12 Okt 2026 |
|
CVE-2026-108818
A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulation of the a...
|
7.3 High | — | 0,53% | 12 Okt 2026 |
|
CVE-2026-108817
A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the library libs/agno/agno/tools/coding....
|
5.5 Medium | — | 1,1% | 12 Okt 2026 |
|
CVE-2026-108816
A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py of the component PythonTools....
|
6.3 Medium | — | 0,31% | 12 Okt 2026 |
|
CVE-2026-108815
A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The atta...
|
3.5 Low | — | 0,24% | 12 Okt 2026 |
|
CVE-2026-108168
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Sto...
|
6.5 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-107869
Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This...
|
4.3 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2026-107866
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS....
|
6.5 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-107865
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects Jet...
|
6.5 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-107864
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affec...
|
6.5 Medium | — | 0,16% | 12 Okt 2026 |
|
CVE-2026-107863
Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access C...
|
5.3 Medium | — | 0,21% | 12 Okt 2026 |
|
CVE-2026-107423
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue...
|
4.3 Medium | — | 0,19% | 12 Okt 2026 |
|
CVE-2023-25996
Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sens...
|
6.5 Medium | — | 0,27% | 12 Okt 2026 |