Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 27 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-65945
apache ranger
Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
|
6.5 Medium | — | 0,64% | 10 Agt 2026 |
|
CVE-2026-65942
apache ranger
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
|
7.5 High | — | 0,59% | 10 Agt 2026 |
|
CVE-2026-61899
apache tapestry
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are recommended t...
|
7.5 High | — | 0,71% | 10 Agt 2026 |
|
CVE-2026-59087
gimp, redhat enterprise linux
A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tric...
|
7.8 High | — | 0,49% | 10 Agt 2026 |
|
CVE-2026-55814
apache ranger
Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
|
7.5 High | — | 0,66% | 10 Agt 2026 |
|
CVE-2026-55799
apache ranger
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
|
9.8 Critical | — | 1,2% | 10 Agt 2026 |
|
CVE-2026-44416
apache ranger
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0.
Users are recommended to upgrade to version 2.9.0,...
|
9.8 Critical | — | 1,2% | 10 Agt 2026 |
|
CVE-2026-42537
apache ranger
Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
|
9.8 Critical | — | 1,3% | 10 Agt 2026 |
|
CVE-2026-40920
apache ranger
Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
|
9.8 Critical | — | 0,73% | 10 Agt 2026 |
|
CVE-2026-32227
apache ranger
SQL Injection vulnerability vulnerability in Apache Ranger.
This issue affects .
Users are recommended to upgrade to version 2.9.0, which fixes the issue.
|
9.8 Critical | — | 0,69% | 10 Agt 2026 |
|
CVE-2026-28672
apache ranger
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.
This issue affects Apache Ranger: from 0.6 through 2....
|
9.8 Critical | — | 2,6% | 10 Agt 2026 |
|
CVE-2026-66915
Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the...
|
10.0 Critical | — | 0,82% | 10 Agt 2026 |
|
CVE-2026-44630
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malfor...
|
7.5 High | — | 0,59% | 10 Agt 2026 |
|
CVE-2026-19404
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an un...
|
6.5 Medium | — | 0,43% | 10 Agt 2026 |
|
CVE-2026-66411
DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications.
An unauthenticated attacker may connect and operate the af...
|
5.3 Medium | — | 0,39% | 10 Agt 2026 |
|
CVE-2026-66410
Android and iOS apps ECOVACS PRO App improperly validate server certificates.
Communication may be retrieved and/or altered.
|
4.8 Medium | — | 0,17% | 10 Agt 2026 |
|
CVE-2026-66409
DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.
The password may be analyzed and obtained to connect to the acces...
|
5.3 Medium | — | 0,33% | 10 Agt 2026 |
|
CVE-2026-66408
The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords.
Physical access to an affected product may allow to obtain the password of th...
|
4.6 Medium | — | 0,20% | 10 Agt 2026 |
|
CVE-2026-66407
DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication.
The WebSocket private key may be retrieved through analyzing the traff...
|
8.1 High | — | 0,33% | 10 Agt 2026 |
|
CVE-2026-66406
DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled.
A man-in-the-middle attack may allow to obtain and/or alter communicatio...
|
4.8 Medium | — | 0,15% | 10 Agt 2026 |
|
CVE-2026-66405
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.
|
8.8 High | — | 0,51% | 10 Agt 2026 |
|
CVE-2026-66404
DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be ret...
|
6.5 Medium | — | 0,20% | 10 Agt 2026 |
|
CVE-2026-66403
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...
|
7.5 High | — | 0,43% | 10 Agt 2026 |
|
CVE-2026-21084
Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.
|
6.9 Medium | — | 0,13% | 10 Agt 2026 |
|
CVE-2026-21083
samsung smart switch
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
|
6.5 Medium | — | 0,26% | 10 Agt 2026 |
|
CVE-2026-21082
samsung health
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
|
5.5 Medium | — | 0,17% | 10 Agt 2026 |
|
CVE-2026-21081
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interactio...
|
5.1 Medium | — | 0,13% | 10 Agt 2026 |
|
CVE-2026-21080
samsung smart switch
Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
|
6.5 Medium | — | 0,17% | 10 Agt 2026 |
|
CVE-2026-21079
samsung smart switch
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.
|
6.5 Medium | — | 0,10% | 10 Agt 2026 |
|
CVE-2026-21078
samsung smart switch
Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.
|
6.5 Medium | — | 0,16% | 10 Agt 2026 |
|
CVE-2026-21077
samsung health
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
|
5.5 Medium | — | 0,13% | 10 Agt 2026 |
|
CVE-2026-21076
samsung health
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
|
5.5 Medium | — | 0,13% | 10 Agt 2026 |
|
CVE-2026-21075
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.
|
5.3 Medium | — | 0,49% | 10 Agt 2026 |
|
CVE-2026-21074
Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.
|
7.2 High | — | 0,14% | 10 Agt 2026 |
|
CVE-2026-21073
samsung android
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.
|
6.1 Medium | — | 0,21% | 10 Agt 2026 |
|
CVE-2026-21072
samsung android
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
|
7.8 High | — | 0,16% | 10 Agt 2026 |
|
CVE-2026-21071
samsung android
Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
|
7.8 High | — | 0,16% | 10 Agt 2026 |
|
CVE-2026-21070
samsung android
Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.
|
4.6 Medium | — | 0,21% | 10 Agt 2026 |
|
CVE-2026-21069
samsung android
Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
|
7.8 High | — | 0,16% | 10 Agt 2026 |
|
CVE-2026-21068
samsung android
Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.
|
7.8 High | — | 0,17% | 10 Agt 2026 |
|
CVE-2026-21067
samsung android
Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
|
7.8 High | — | 0,16% | 10 Agt 2026 |
|
CVE-2026-21066
samsung android
Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
|
7.8 High | — | 0,16% | 10 Agt 2026 |
|
CVE-2026-21065
samsung android
Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
|
7.8 High | — | 0,15% | 10 Agt 2026 |
|
CVE-2026-21064
samsung android
Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.
|
5.5 Medium | — | 0,12% | 10 Agt 2026 |
|
CVE-2026-21063
samsung android
Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.
|
6.1 Medium | — | 0,20% | 10 Agt 2026 |
|
CVE-2026-64940
Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can acces...
|
8.6 High | — | 0,40% | 10 Agt 2026 |
|
CVE-2026-57279
Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged i...
|
6.0 Medium | — | 0,32% | 10 Agt 2026 |
|
CVE-2026-21062
samsung android
Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.
|
3.3 Low | — | 0,13% | 10 Agt 2026 |
|
CVE-2026-21061
samsung android
Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for trig...
|
6.5 Medium | — | 0,41% | 10 Agt 2026 |
|
CVE-2026-21060
samsung android
Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles.
|
4.6 Medium | — | 0,21% | 10 Agt 2026 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.