Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 141–160 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 31 Mar 2026, 21:14 WIB

CVE-2026-34214

Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:14:47.982Z. Updated 2026-03-31T14:28:53.287Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:28 WIB

Official record

HighPublished 31 Mar 2026, 21:10 WIB

CVE-2026-34209

mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 141 to 160 of 6236.First page Next page

Published 2026-03-31T14:10:46.416Z. Updated 2026-04-02T15:13:32.047Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 22:13 WIB

Official record

MedPublished 31 Mar 2026, 21:10 WIB

CVE-2026-34504

OpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Provider

OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URLs. A malicious or compromised fal relay can exploit unguarded image download fetches to expose internal service metadata and responses thro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:10:35.607Z. Updated 2026-09-24T14:17:28.070Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:17 WIB

Official record

HighPublished 31 Mar 2026, 21:10 WIB

CVE-2026-34503

OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:10:34.746Z. Updated 2026-09-24T14:17:27.119Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:17 WIB

Official record

HighPublished 31 Mar 2026, 21:10 WIB

CVE-2026-33581

OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:10:33.685Z. Updated 2026-09-24T14:17:26.158Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:17 WIB

Official record

MedPublished 31 Mar 2026, 21:10 WIB

CVE-2026-33580

OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:10:33.057Z. Updated 2026-09-24T14:17:25.206Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:17 WIB

Official record

CritPublished 31 Mar 2026, 21:10 WIB

CVE-2026-33579

OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:10:32.407Z. Updated 2026-09-24T14:17:24.260Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:17 WIB

Official record

MedPublished 31 Mar 2026, 21:10 WIB

CVE-2026-33578

OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions

OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to bypass sender restrictions and interact with bots despite configured allow…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:10:31.778Z. Updated 2026-09-24T14:17:23.320Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:17 WIB

Official record

HighPublished 31 Mar 2026, 21:10 WIB

CVE-2026-33577

OpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in node-pairing.ts to extend privileges onto paired nodes beyond their autho…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:10:31.118Z. Updated 2026-09-24T14:17:22.351Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:17 WIB

Official record

MedPublished 31 Mar 2026, 21:10 WIB

CVE-2026-33576

OpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:10:30.529Z. Updated 2026-09-24T14:17:21.386Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:17 WIB

Official record

MedPublished 31 Mar 2026, 21:10 WIB

CVE-2026-34210

mppx has Stripe charge credential replay via missing idempotency check

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new challenge, and the serv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:10:10.463Z. Updated 2026-03-31T18:53:01.611Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:53 WIB

Official record

HighPublished 31 Mar 2026, 21:05 WIB

CVE-2026-34377

Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:05:59.959Z. Updated 2026-03-31T17:18:12.932Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 00:18 WIB

Official record

CritPublished 31 Mar 2026, 21:02 WIB

CVE-2026-34202

Zebra node crash — V5 transaction hash panic (P2P reachable)

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that pass…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:02:56.454Z. Updated 2026-03-31T17:17:30.860Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 00:17 WIB

Official record

HighPublished 31 Mar 2026, 20:57 WIB

CVE-2026-34200

Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T13:57:42.003Z. Updated 2026-03-31T14:30:36.656Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:30 WIB

Official record

HighPublished 31 Mar 2026, 20:51 WIB

CVE-2026-20915

Stored cross-site scripting in Pending Changes sidebar

Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T13:51:02.358Z. Updated 2026-03-31T17:15:54.753Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 00:15 WIB

Official record

HighPublished 31 Mar 2026, 20:50 WIB

CVE-2026-34172

Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T13:50:17.240Z. Updated 2026-03-31T19:09:13.342Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 02:09 WIB

Official record

LowPublished 31 Mar 2026, 20:47 WIB

CVE-2026-33762

go-git: Missing validation decoding Index v4 files leads to panic

go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T13:47:42.378Z. Updated 2026-03-31T18:53:08.221Z.

CVSS2.8v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:53 WIB

Official record

MedPublished 31 Mar 2026, 20:46 WIB

CVE-2026-34165

go-git: Maliciously crafted idx file can cause asymmetric memory consumption

go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T13:46:37.688Z. Updated 2026-04-02T15:10:17.724Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 22:10 WIB

Official record

HighPublished 31 Mar 2026, 20:44 WIB

CVE-2026-33276

XSS in Unified Search via Unescaped Host/Service Names

Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitrary JavaScript in the browsers of other users performing searches in the Unified Search feature.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T13:44:17.857Z. Updated 2026-03-31T15:45:36.069Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 22:45 WIB

Official record

CritPublished 31 Mar 2026, 20:43 WIB

CVE-2026-34162

FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T13:43:20.981Z. Updated 2026-03-31T14:33:31.305Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:33 WIB

Official record