Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-75597
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blu...
|
5.3 Medium | — | 0,30% | 9 Okt 2026 |
|
CVE-2026-75347
EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logi...
|
7.5 High | — | 0,42% | 9 Okt 2026 |
|
CVE-2026-55797
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to...
|
8.8 High | — | 1,5% | 9 Okt 2026 |
|
CVE-2026-48484
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` u...
|
6.5 Medium | — | 0,31% | 9 Okt 2026 |
|
CVE-2026-42695
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allow...
|
6.5 Medium | — | 0,13% | 9 Okt 2026 |
|
CVE-2026-108160
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the deskto...
|
7.5 High | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-108159
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by...
|
7.5 High | — | 0,33% | 9 Okt 2026 |
|
CVE-2026-108158
plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via...
|
6.5 Medium | — | 0,33% | 9 Okt 2026 |
|
CVE-2026-108157
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing...
|
8.1 High | — | 0,53% | 9 Okt 2026 |
|
CVE-2026-108156
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value fro...
|
7.1 High | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-108119
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the reso...
|
6.3 Medium | — | 0,14% | 9 Okt 2026 |
|
CVE-2026-108093
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before derefer...
|
5.5 Medium | — | 0,11% | 9 Okt 2026 |
|
CVE-2026-107815
mariadb
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table typ...
|
8.5 High | — | 0,90% | 9 Okt 2026 |
|
CVE-2016-20098
Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit tool...
|
5.4 Medium | — | 0,17% | 9 Okt 2026 |
|
CVE-2026-90983
Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass.
This issue affects Hayat Mobi...
|
8.2 High | — | 0,26% | 9 Okt 2026 |
|
CVE-2026-75346
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a r...
|
7.5 High | — | 0,54% | 9 Okt 2026 |
|
CVE-2026-75349
EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker...
|
7.5 High | — | 0,45% | 9 Okt 2026 |
|
CVE-2026-75348
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The...
|
7.5 High | — | 0,51% | 9 Okt 2026 |
|
CVE-2026-75345
OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.
|
7.5 High | — | 0,45% | 9 Okt 2026 |
|
CVE-2026-108113
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authentica...
|
8.8 High | — | 0,64% | 9 Okt 2026 |
|
CVE-2026-108112
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}...
|
5.4 Medium | — | 0,22% | 9 Okt 2026 |
|
CVE-2026-108111
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticate...
|
4.3 Medium | — | 0,20% | 9 Okt 2026 |
|
CVE-2026-108110
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects...
|
6.8 Medium | — | 0,24% | 9 Okt 2026 |
|
CVE-2026-107814
mariadb
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the d...
|
8.4 High | — | 0,28% | 9 Okt 2026 |
|
CVE-2026-107813
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide...
|
8.8 High | — | 0,31% | 9 Okt 2026 |
|
CVE-2026-107812
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest...
|
7.5 High | — | 0,17% | 9 Okt 2026 |
|
CVE-2026-107811
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses...
|
8.8 High | — | 0,36% | 9 Okt 2026 |
|
CVE-2026-107810
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx an...
|
8.1 High | — | 0,36% | 9 Okt 2026 |
|
CVE-2026-107809
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the fron...
|
8.8 High | — | 0,19% | 9 Okt 2026 |
|
CVE-2026-107808
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when Enable...
|
8.1 High | — | 0,41% | 9 Okt 2026 |
|
CVE-2026-107807
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parame...
|
8.8 High | — | 0,31% | 9 Okt 2026 |
|
CVE-2026-107783
Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Cons...
|
5.9 Medium | — | 0,10% | 9 Okt 2026 |
|
CVE-2026-104084
SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated aga...
|
8.8 High | — | 0,27% | 9 Okt 2026 |
|
CVE-2026-104083
SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads i...
|
6.1 Medium | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-104082
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount scr...
|
7.2 High | — | 0,61% | 9 Okt 2026 |
|
CVE-2026-102554
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause...
|
8.2 High | — | 0,35% | 9 Okt 2026 |
|
CVE-2026-95702
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve co...
|
8.5 High | — | 0,08% | 9 Okt 2026 |
|
CVE-2026-78795
An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information
|
7.5 High | — | 0,45% | 9 Okt 2026 |
|
CVE-2026-39460
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration fi...
|
8.1 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-39453
Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch...
|
8.3 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-33367
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootload...
|
8.1 High | — | 0,29% | 9 Okt 2026 |
|
CVE-2026-33272
A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain...
|
4.9 Medium | — | 0,15% | 9 Okt 2026 |
|
CVE-2026-32645
Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
|
6.0 Medium | — | 0,12% | 9 Okt 2026 |
|
CVE-2026-29797
No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same soft...
|
7.1 High | — | 0,16% | 9 Okt 2026 |
|
CVE-2026-28745
Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a maliciou...
|
7.5 High | — | 0,22% | 9 Okt 2026 |
|
CVE-2026-15340
lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
|
9.8 Critical | — | 0,60% | 9 Okt 2026 |
|
CVE-2026-108125
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author.
This issue affects wp-post-author version 4.0.0 pri...
|
7.1 High | — | 0,22% | 9 Okt 2026 |
|
CVE-2026-108124
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author.
This issue affects wp-post-author before 4.1.0.
|
4.9 Medium | — | 0,24% | 9 Okt 2026 |
|
CVE-2026-108109
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated a...
|
9.1 Critical | — | 0,39% | 9 Okt 2026 |
|
CVE-2026-108108
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied re...
|
7.1 High | — | 0,23% | 9 Okt 2026 |