Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filtersnone active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 397,835 published records · 1,762 KEV · 397,508 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

397,835 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit16,4754.1%
High70,95918%
Med84,65121%
Low8,6292.2%
None1100.03%
Legacy1230.03%
Unscored216,88855%

Matching records by UTC month

Nov 244,054
Dec 243,433
Jan 254,273
Feb 253,673
Mar 254,001
Apr 254,033
May 253,980
Jun 253,682
Jul 253,774
Aug 253,629
Sep 254,319
Oct 254,274
Nov 253,020
Dec 255,493
Jan 264,302
Feb 264,616
Mar 266,236
Apr 265,813
May 266,933
Jun 267,949
Jul 269,759
Aug 2612,259
Sep 2614,934
Oct 2616,156

Signal coverage

KEV-listed: 1,762
With a forecast: 397,508
Unknown date: 0
Unscored severity: 216,888

Share of cohort: KEV 0.44% · forecast 100% · unscored 55%.

Showing 1–20 of 397,835By severity band: Critical · 9.0–10.0 16,475, High · 7.0–8.9 70,959, Medium · 4.0–6.9 84,651, Low · 0.1–3.9 8,629, None · scored 0.0 110, Legacy · v2 only 123, Unscored · no CNA metric 216,888

MedPublished 29 Oct 2026, 23:01 WIB

CVE-2026-118673

KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the pla…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T16:01:55.635Z. Updated 2026-10-29T16:01:55.635Z.

CVSS4.1v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 23:01 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2025-13050

Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users

Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:50.079Z. Updated 2026-10-29T15:58:50.079Z.

CVSS5.4v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

CritPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119145

Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:23.465Z. Updated 2026-10-29T15:58:23.465Z.

CVSS9.4v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

HighPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119144

Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:22.718Z. Updated 2026-10-29T15:58:22.718Z.

CVSS8.7v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119143

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:21.991Z. Updated 2026-10-29T15:58:21.991Z.

CVSS5.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119142

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedder…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:21.265Z. Updated 2026-10-29T15:58:21.265Z.

CVSS5.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119141

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:20.531Z. Updated 2026-10-29T15:58:20.531Z.

CVSS6.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119140

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing an undisposed fiber dro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:19.800Z. Updated 2026-10-29T15:58:19.800Z.

CVSS5.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119139

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:19.056Z. Updated 2026-10-29T15:58:19.056Z.

CVSS5.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119138

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:18.284Z. Updated 2026-10-29T15:58:18.284Z.

CVSS5.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119137

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:17.461Z. Updated 2026-10-29T15:58:17.461Z.

CVSS6.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119136

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host varia…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:16.692Z. Updated 2026-10-29T15:58:16.692Z.

CVSS5.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119135

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created StreamReader<U> that the embe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:15.914Z. Updated 2026-10-29T15:58:15.914Z.

CVSS5.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119134

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the pe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:15.105Z. Updated 2026-10-29T15:58:15.105Z.

CVSS6.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

LowPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119133

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:14.355Z. Updated 2026-10-29T15:58:14.355Z.

CVSS2.1v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119132

Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter

Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:13.552Z. Updated 2026-10-29T15:58:13.552Z.

CVSS5.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119131

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a '?' after byte 65535, overflowing a u16 index in the http crate and triggering a host panic.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:12.765Z. Updated 2026-10-29T15:58:12.765Z.

CVSS6.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

LowPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119130

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:12.004Z. Updated 2026-10-29T15:58:12.004Z.

CVSS2.1v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

HighPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119129

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:11.241Z. Updated 2026-10-29T15:58:11.241Z.

CVSS8.6v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

CritPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119128

ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:10.483Z. Updated 2026-10-29T15:58:10.483Z.

CVSS9.1v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

Showing 1 to 20 of 397835.Next page