Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-108638
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108637
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108636
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import depa...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108635
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authent...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108634
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DEL...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108633
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /s...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108632
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read d...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108631
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108630
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108629
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108628
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticat...
|
8.1 High | — | 0,23% | 10 Okt 2026 |
|
CVE-2026-108627
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data r...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108626
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to rea...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108625
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/m...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108624
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to d...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108623
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system aud...
|
7.1 High | — | 0,30% | 10 Okt 2026 |
|
CVE-2026-108622
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entri...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108621
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organization...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108620
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organ...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108619
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/mess...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108618
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sys...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108617
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/mes...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108616
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI e...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108615
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to dele...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108614
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI eva...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108613
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublis...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108612
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated user...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108611
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word...
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108610
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word te...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108609
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via th...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108608
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108607
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by s...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-108606
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records....
|
5.4 Medium | — | 0,27% | 10 Okt 2026 |
|
CVE-2026-108605
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR t...
|
4.3 Medium | — | 0,24% | 10 Okt 2026 |
|
CVE-2026-97853
Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.
Decimal.round/3 builds the full result for the requested number of...
|
6.9 Medium | — | 0,14% | 10 Okt 2026 |
|
CVE-2026-81797
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
|
9.8 Critical | — | 0,32% | 10 Okt 2026 |
|
CVE-2026-78535
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
|
9.8 Critical | — | 0,34% | 10 Okt 2026 |
|
CVE-2026-78534
Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.
|
7.1 High | — | 0,15% | 10 Okt 2026 |
|
CVE-2026-78533
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
|
9.8 Critical | — | 0,34% | 10 Okt 2026 |
|
CVE-2026-78532
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
|
7.1 High | — | 0,15% | 10 Okt 2026 |
|
CVE-2026-78531
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-78530
Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
|
7.7 High | — | 0,40% | 10 Okt 2026 |
|
CVE-2026-78529
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-66569
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-66568
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-66567
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
|
9.8 Critical | — | 0,33% | 10 Okt 2026 |
|
CVE-2026-66566
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
|
8.1 High | — | 0,28% | 10 Okt 2026 |
|
CVE-2026-66565
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-66564
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |
|
CVE-2026-66563
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
|
9.8 Critical | — | 0,31% | 10 Okt 2026 |