Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-108864
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused...
|
4.2 Medium | — | 0,17% | 11 Okt 2026 |
|
CVE-2026-108863
Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is...
|
7.5 High | — | 0,46% | 11 Okt 2026 |
|
CVE-2026-108862
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying...
|
5.3 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-108861
Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. A...
|
4.3 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-108860
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in...
|
9.1 Critical | — | 0,48% | 11 Okt 2026 |
|
CVE-2026-108859
mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sendin...
|
7.5 High | — | 0,55% | 11 Okt 2026 |
|
CVE-2026-108858
Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into r...
|
5.5 Medium | — | 0,11% | 11 Okt 2026 |
|
CVE-2026-108857
Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks...
|
3.3 Low | — | 0,11% | 11 Okt 2026 |
|
CVE-2026-108856
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1...
|
4.2 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-108855
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps v...
|
5.4 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-108854
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplyin...
|
5.4 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-108853
UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RA...
|
8.1 High | — | 0,30% | 11 Okt 2026 |
|
CVE-2026-108852
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remark...
|
4.7 Medium | — | 0,19% | 11 Okt 2026 |
|
CVE-2026-108851
phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::s...
|
3.3 Low | — | 0,10% | 11 Okt 2026 |
|
CVE-2026-108850
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting...
|
5.3 Medium | — | 0,24% | 11 Okt 2026 |
|
CVE-2026-108839
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace...
|
4.2 Medium | — | 0,25% | 11 Okt 2026 |
|
CVE-2026-108699
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args()...
|
6.5 Medium | — | 0,13% | 11 Okt 2026 |
|
CVE-2026-108698
hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved...
|
6.5 Medium | — | 0,24% | 11 Okt 2026 |
|
CVE-2026-108697
CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because Resource...
|
4.3 Medium | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-108681
A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console....
|
4.3 Medium | — | 0,45% | 11 Okt 2026 |
|
CVE-2026-108760
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently disc...
|
7.6 High | — | 0,24% | 11 Okt 2026 |
|
CVE-2026-108759
mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the san...
|
6.8 Medium | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-108758
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by s...
|
8.2 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-108757
Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /p...
|
6.5 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-108756
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding...
|
5.4 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-108755
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion end...
|
5.3 Medium | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-108754
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before ex...
|
3.3 Low | — | 0,11% | 11 Okt 2026 |
|
CVE-2026-108753
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret....
|
9.4 Critical | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registeri...
|
4.2 Medium | — | 0,25% | 11 Okt 2026 |
|
CVE-2026-108751
MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside...
|
4.4 Medium | — | 0,14% | 11 Okt 2026 |
|
CVE-2026-108750
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. A...
|
4.3 Medium | — | 0,27% | 11 Okt 2026 |
|
CVE-2026-108749
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts...
|
3.7 Low | — | 0,30% | 11 Okt 2026 |
|
CVE-2026-108748
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticate...
|
5.3 Medium | — | 0,30% | 11 Okt 2026 |
|
CVE-2026-108747
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by s...
|
4.2 Medium | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108746
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for r...
|
8.8 High | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-108745
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files...
|
3.1 Low | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108744
pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects....
|
7.0 High | — | 0,55% | 11 Okt 2026 |
|
CVE-2026-108742
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist creden...
|
4.3 Medium | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-108741
Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved a...
|
3.1 Low | — | 0,18% | 11 Okt 2026 |
|
CVE-2026-108740
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected accoun...
|
8.3 High | — | 0,33% | 11 Okt 2026 |
|
CVE-2026-108739
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GE...
|
7.5 High | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-108738
Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID C...
|
4.2 Medium | — | 0,11% | 11 Okt 2026 |
|
CVE-2026-108737
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager do...
|
6.8 Medium | — | 0,25% | 11 Okt 2026 |
|
CVE-2026-108736
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists...
|
3.7 Low | — | 0,21% | 11 Okt 2026 |
|
CVE-2026-108735
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_ur...
|
4.3 Medium | — | 0,27% | 11 Okt 2026 |
|
CVE-2026-108734
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked...
|
4.3 Medium | — | 0,25% | 11 Okt 2026 |
|
CVE-2026-108733
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation...
|
4.3 Medium | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-108732
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_a...
|
4.3 Medium | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-108731
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_jo...
|
5.4 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-108730
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authent...
|
4.3 Medium | — | 0,25% | 11 Okt 2026 |