Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 1401–1420 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 25 Mar 2026, 23:04 WIB

CVE-2026-20004

CVE-2026-20004

A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during TLS connection setup. An attacker could exploit this vulnerability by repeat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:04:48.379Z. Updated 2026-03-26T17:38:43.815Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 00:38 WIB

Official record

HighPublished 25 Mar 2026, 23:04 WIB

CVE-2024-58341

OpenCart Core 4.0.2.3 SQL Injection via search Parameter

OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'search' parameter. Attackers can send GET requests to the product search endpoint with malicious 'search' values to extract sensitive database information …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1401 to 1420 of 6236.First page Next page

Published 2026-03-25T16:04:35.565Z. Updated 2026-05-14T02:07:15.526Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:07 WIB

Official record

HighPublished 25 Mar 2026, 23:04 WIB

CVE-2026-20125

CVE-2026-20125

A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:04:29.117Z. Updated 2026-03-25T17:52:07.963Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 00:52 WIB

Official record

HighPublished 25 Mar 2026, 23:03 WIB

CVE-2026-20012

CVE-2026-20012

A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:03:12.439Z. Updated 2026-03-26T17:37:50.517Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 00:37 WIB

Official record

HighPublished 25 Mar 2026, 23:02 WIB

CVE-2026-20086

CVE-2026-20086

A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:02:55.912Z. Updated 2026-03-26T17:40:42.427Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 00:40 WIB

Official record

HighPublished 25 Mar 2026, 23:02 WIB

CVE-2026-20084

CVE-2026-20084

A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded between VLANs, resulting in a denial of service (DoS) condition. This vulnerability is due to improper handling of BOOTP packets on Cisco Catalyst 9000 Series …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:02:39.119Z. Updated 2026-03-26T17:35:50.008Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 00:35 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:24 WIB

CVE-2026-3218

Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:24:55.196Z. Updated 2026-03-26T14:42:31.151Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 21:42 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:24 WIB

CVE-2026-3217

SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:24:30.977Z. Updated 2026-03-25T19:59:46.310Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 02:59 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:24 WIB

CVE-2026-3216

Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:24:17.937Z. Updated 2026-03-27T13:58:20.679Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2026, 20:58 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:24 WIB

CVE-2026-3215

Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:24:03.936Z. Updated 2026-03-26T14:40:02.415Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 21:40 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:23 WIB

CVE-2026-3214

CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:23:43.968Z. Updated 2026-03-26T13:44:25.007Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:44 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:22 WIB

CVE-2026-3213

Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:22:26.583Z. Updated 2026-03-26T14:47:06.325Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 21:47 WIB

Official record

HighPublished 25 Mar 2026, 22:22 WIB

CVE-2026-24750

Kiteworks Secure Data Forms vulnerable to Cross-site Scripting

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:22:16.694Z. Updated 2026-03-26T19:52:12.631Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 02:52 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:22 WIB

CVE-2026-3212

Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:22:11.601Z. Updated 2026-03-26T14:38:54.095Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 21:38 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:21 WIB

CVE-2026-3211

Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:21:53.456Z. Updated 2026-03-26T14:36:19.903Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 21:36 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:21 WIB

CVE-2026-3210

Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011

Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:21:43.470Z. Updated 2026-03-26T14:34:55.742Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 21:34 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:21 WIB

CVE-2026-2349

UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:21:28.488Z. Updated 2026-03-25T20:03:40.679Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 03:03 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:20 WIB

CVE-2026-2348

Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:20:53.201Z. Updated 2026-03-26T14:32:07.043Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 21:32 WIB

Official record

UnscoredPublished 25 Mar 2026, 22:20 WIB

CVE-2026-1917

Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:20:20.274Z. Updated 2026-03-26T14:11:44.215Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 21:11 WIB

Official record

LowPublished 25 Mar 2026, 22:04 WIB

CVE-2026-4363

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisions.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T15:04:46.503Z. Updated 2026-03-25T19:57:37.853Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 02:57 WIB

Official record