Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-108976
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: th...
|
7.8 High | — | 0,51% | 11 Okt 2026 |
|
CVE-2026-108963
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticat...
|
8.8 High | — | 1,7% | 11 Okt 2026 |
|
CVE-2026-108925
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface.
This issue affect...
|
6.1 Medium | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108768
A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler....
|
4.3 Medium | — | 0,45% | 11 Okt 2026 |
|
CVE-2026-59508
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Interuse i-Bos.
This issue affects i-Bos: 3.0.
|
5.9 Medium | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-19935
The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan...
|
7.5 High | — | 0,18% | 11 Okt 2026 |
|
CVE-2026-19740
The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND...
|
6.5 Medium | — | 0,10% | 11 Okt 2026 |
|
CVE-2026-19739
The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connecti...
|
6.5 Medium | — | 0,10% | 11 Okt 2026 |
|
CVE-2026-19738
The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked NODE_RX_TYPE...
|
6.5 Medium | — | 0,10% | 11 Okt 2026 |
|
CVE-2026-19737
i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_cfg->rx.data...
|
5.5 Medium | — | 0,10% | 11 Okt 2026 |
|
CVE-2026-19736
The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData(). On i.MX RT...
|
7.8 High | — | 0,11% | 11 Okt 2026 |
|
CVE-2026-19735
The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus a uptime-derived offset, wher...
|
4.8 Medium | — | 0,16% | 11 Okt 2026 |
|
CVE-2026-19669
The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two variable-...
|
7.8 High | — | 0,12% | 11 Okt 2026 |
|
CVE-2026-19577
net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whether the neigh...
|
7.1 High | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-19576
The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with GT911_TOUCH_POINTS_MSK (0...
|
6.8 Medium | — | 0,17% | 11 Okt 2026 |
|
CVE-2026-18418
The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. Th...
|
3.4 Low | — | 0,11% | 11 Okt 2026 |
|
CVE-2026-108913
omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include e...
|
7.1 High | — | 0,37% | 11 Okt 2026 |
|
CVE-2026-107761
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the calle...
|
5.3 Medium | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-108905
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access...
|
7.5 High | — | 0,31% | 11 Okt 2026 |
|
CVE-2026-108904
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserCont...
|
6.5 Medium | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-108903
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a clie...
|
5.3 Medium | — | 0,27% | 11 Okt 2026 |
|
CVE-2026-108902
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to d...
|
8.1 High | — | 0,38% | 11 Okt 2026 |
|
CVE-2026-108891
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read o...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108888
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export depar...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108887
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comm...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108886
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retr...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108885
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete...
|
5.4 Medium | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108884
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete mes...
|
5.4 Medium | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108883
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party applicat...
|
6.5 Medium | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108882
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remov...
|
5.4 Medium | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108881
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108880
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-c...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108879
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108878
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108877
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calli...
|
5.4 Medium | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108876
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user r...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108875
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108874
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/ch...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108873
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/do...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108872
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108871
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users...
|
5.4 Medium | — | 0,17% | 11 Okt 2026 |
|
CVE-2026-108870
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to mod...
|
5.4 Medium | — | 0,17% | 11 Okt 2026 |
|
CVE-2026-108869
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/ap...
|
4.3 Medium | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108868
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/send...
|
4.3 Medium | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108867
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read ot...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108866
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. L...
|
4.3 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108684
A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoContro...
|
6.3 Medium | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-108683
A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such man...
|
4.3 Medium | — | 0,31% | 11 Okt 2026 |
|
CVE-2026-108682
A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipula...
|
5.4 Medium | — | 0,40% | 11 Okt 2026 |
|
CVE-2026-108865
AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server...
|
8.2 High | — | 0,32% | 11 Okt 2026 |