Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-108729
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private atta...
|
5.9 Medium | — | 0,29% | 11 Okt 2026 |
|
CVE-2026-108728
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environmen...
|
6.5 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-108727
EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scop...
|
4.3 Medium | — | 0,27% | 11 Okt 2026 |
|
CVE-2026-108726
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by...
|
4.3 Medium | — | 0,25% | 11 Okt 2026 |
|
CVE-2026-108725
Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via PO...
|
5.4 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-108724
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the Acc...
|
5.3 Medium | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-108723
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolvi...
|
2.5 Low | — | 0,14% | 11 Okt 2026 |
|
CVE-2026-108722
open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcr...
|
4.2 Medium | — | 0,24% | 11 Okt 2026 |
|
CVE-2026-108721
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylis...
|
5.3 Medium | — | 0,13% | 11 Okt 2026 |
|
CVE-2026-108720
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because custom...
|
4.3 Medium | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-108719
LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callback...
|
5.0 Medium | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-108718
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients with...
|
8.1 High | — | 0,27% | 11 Okt 2026 |
|
CVE-2026-108717
Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants...
|
6.3 Medium | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-108716
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing...
|
5.3 Medium | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-108715
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the re...
|
4.3 Medium | — | 0,27% | 11 Okt 2026 |
|
CVE-2026-108714
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocke...
|
7.5 High | — | 0,36% | 11 Okt 2026 |
|
CVE-2026-108713
SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records...
|
4.3 Medium | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-108712
SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view othe...
|
4.3 Medium | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-108711
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because get...
|
4.3 Medium | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-108710
NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and...
|
6.5 Medium | — | 0,35% | 11 Okt 2026 |
|
CVE-2026-108584
A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipul...
|
5.3 Medium | — | 0,36% | 11 Okt 2026 |
|
CVE-2026-108578
A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation...
|
5.3 Medium | — | 0,49% | 11 Okt 2026 |
|
CVE-2026-108577
A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the compon...
|
4.3 Medium | — | 0,29% | 11 Okt 2026 |
|
CVE-2026-108576
A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of...
|
10.0 Critical | — | 2,5% | 11 Okt 2026 |
|
CVE-2026-108575
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolutio...
|
6.3 Medium | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-108574
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm/proxy/spend_tracking/spend_ma...
|
4.3 Medium | — | 0,24% | 11 Okt 2026 |
|
CVE-2026-108573
A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component...
|
5.5 Medium | — | 0,17% | 11 Okt 2026 |
|
CVE-2026-108572
A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Pr...
|
4.3 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-108571
A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php...
|
7.3 High | — | 0,32% | 11 Okt 2026 |
|
CVE-2026-108570
A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngi...
|
6.3 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-108569
A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensi...
|
6.3 Medium | — | 0,30% | 11 Okt 2026 |
|
CVE-2026-108568
A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/...
|
4.3 Medium | — | 0,13% | 11 Okt 2026 |
|
CVE-2026-108567
A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler...
|
4.3 Medium | — | 0,53% | 11 Okt 2026 |
|
CVE-2026-108566
A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php o...
|
3.5 Low | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-108544
A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxviewer.document.docx.reader.ViewTx...
|
6.3 Medium | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-108543
A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the ar...
|
6.3 Medium | — | 0,34% | 11 Okt 2026 |
|
CVE-2026-108542
A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Re...
|
6.3 Medium | — | 0,20% | 11 Okt 2026 |
|
CVE-2026-97183
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber,...
|
4.3 Medium | — | 0,18% | 11 Okt 2026 |
|
CVE-2026-96227
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be...
|
8.8 High | — | 0,28% | 11 Okt 2026 |
|
CVE-2026-94235
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscri...
|
4.3 Medium | — | 0,15% | 11 Okt 2026 |
|
CVE-2026-93550
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before d...
|
4.3 Medium | — | 0,18% | 11 Okt 2026 |
|
CVE-2026-91829
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers...
|
7.1 High | — | 0,16% | 11 Okt 2026 |
|
CVE-2026-89305
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQ...
|
6.5 Medium | — | 0,22% | 11 Okt 2026 |
|
CVE-2026-89304
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform bli...
|
6.5 Medium | — | 0,23% | 11 Okt 2026 |
|
CVE-2026-89302
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to pe...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89299
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perfo...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89297
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to per...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89287
The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers t...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89285
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated at...
|
8.6 High | — | 0,26% | 11 Okt 2026 |
|
CVE-2026-89283
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-load...
|
8.6 High | — | 0,22% | 11 Okt 2026 |