Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-104082
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount scr...
|
7.2 High | — | 0,61% | 9 Okt 2026 |
|
CVE-2026-102554
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause...
|
8.2 High | — | 0,35% | 9 Okt 2026 |
|
CVE-2026-95702
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve co...
|
8.5 High | — | 0,08% | 9 Okt 2026 |
|
CVE-2026-78795
An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information
|
7.5 High | — | 0,45% | 9 Okt 2026 |
|
CVE-2026-39460
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration fi...
|
8.1 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-39453
Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch...
|
8.3 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-33367
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootload...
|
8.1 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-33272
A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain...
|
4.9 Medium | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-32645
Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
|
6.0 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-29797
No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same soft...
|
7.1 High | — | 0,16% | 9 Okt 2026 |
|
CVE-2026-28745
Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a maliciou...
|
7.5 High | — | 0,22% | 9 Okt 2026 |
|
CVE-2026-15340
lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
|
9.8 Critical | — | 0,60% | 9 Okt 2026 |
|
CVE-2026-108125
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author.
This issue affects wp-post-author version 4.0.0 pri...
|
7.1 High | — | 0,22% | 9 Okt 2026 |
|
CVE-2026-108124
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author.
This issue affects wp-post-author before 4.1.0.
|
4.9 Medium | — | 0,24% | 9 Okt 2026 |
|
CVE-2026-108109
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated a...
|
9.1 Critical | — | 0,39% | 9 Okt 2026 |
|
CVE-2026-108108
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied re...
|
7.1 High | — | 0,23% | 9 Okt 2026 |
|
CVE-2026-108107
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into...
|
9.8 Critical | — | 0,41% | 9 Okt 2026 |
|
CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed len...
|
7.5 High | — | 0,37% | 9 Okt 2026 |
|
CVE-2026-108105
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME v...
|
5.9 Medium | — | 0,52% | 9 Okt 2026 |
|
CVE-2026-108104
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement all...
|
4.8 Medium | — | 0,22% | 9 Okt 2026 |
|
CVE-2026-108103
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to re...
|
5.3 Medium | — | 0,39% | 9 Okt 2026 |
|
CVE-2026-108102
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c that allows remote unauthenticated attac...
|
5.3 Medium | — | 0,39% | 9 Okt 2026 |
|
CVE-2026-108101
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with clien...
|
7.5 High | — | 0,39% | 9 Okt 2026 |
|
CVE-2026-108100
HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /...
|
6.5 Medium | — | 0,27% | 9 Okt 2026 |
|
CVE-2026-107806
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-contro...
|
9.4 Critical | — | 0,33% | 9 Okt 2026 |
|
CVE-2026-107805
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-c...
|
7.5 High | — | 0,44% | 9 Okt 2026 |
|
CVE-2026-107804
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin be...
|
5.3 Medium | — | 0,22% | 9 Okt 2026 |
|
CVE-2026-105278
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management in...
|
9.8 Critical | — | 0,34% | 9 Okt 2026 |
|
CVE-2026-104117
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd...
|
1.9 Low | — | 0,11% | 9 Okt 2026 |
|
CVE-2026-104116
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which...
|
1.9 Low | — | 0,11% | 9 Okt 2026 |
|
CVE-2026-104115
A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/...
|
5.4 Medium | — | 0,14% | 9 Okt 2026 |
|
CVE-2026-104114
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd...
|
5.4 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-104113
A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface...
|
5.4 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-104112
A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in...
|
6.8 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-104081
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str...
|
8.1 High | — | 0,77% | 9 Okt 2026 |
|
CVE-2026-102916
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses gue...
|
6.8 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-94067
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local F...
|
8.1 High | — | 0,34% | 9 Okt 2026 |
|
CVE-2026-94066
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: fro...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-94065
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.
|
8.8 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-94064
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop Word...
|
8.8 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-94063
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue...
|
7.1 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-92085
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Manag...
|
5.4 Medium | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-85479
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect...
|
5.3 Medium | — | 0,25% | 9 Okt 2026 |
|
CVE-2026-79363
Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML con...
|
5.9 Medium | — | 0,18% | 9 Okt 2026 |
|
CVE-2026-62026
Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from...
|
7.1 High | — | 0,09% | 9 Okt 2026 |
|
CVE-2026-108063
A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a spe...
|
5.5 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-107803
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection th...
|
6.5 Medium | — | 0,25% | 9 Okt 2026 |
|
CVE-2026-107785
Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is...
|
6.3 Medium | — | 0,14% | 9 Okt 2026 |
|
CVE-2026-106581
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide...
|
7.3 High | — | 0,08% | 9 Okt 2026 |
|
CVE-2026-105281
The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to...
|
7.5 High | — | 0,31% | 9 Okt 2026 |