Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1481–1500 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 27 Aug 2026, 04:25 WIB

CVE-2026-77317

SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite

SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins with the same characte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T21:25:46.531Z. Updated 2026-08-29T02:53:27.656Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 09:53 WIB

Official record

MedPublished 27 Aug 2026, 04:24 WIB

CVE-2026-65930

LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1481 to 1500 of 12259.First page Next page

Published 2026-08-26T21:24:52.232Z. Updated 2026-08-27T18:08:06.624Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 01:08 WIB

Official record

HighPublished 27 Aug 2026, 04:21 WIB

CVE-2026-64632

CVE-2026-64632

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T21:21:41.412Z. Updated 2026-08-27T15:04:10.844Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:04 WIB

Official record

CritPublished 27 Aug 2026, 04:21 WIB

CVE-2026-65646

CVE-2026-65646

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T21:21:41.144Z. Updated 2026-09-11T17:16:03.698Z.

CVSS9.9v3.0KEVNot listedEPSSPresentUpdated12 Sep 2026, 00:16 WIB

Official record

HighPublished 27 Aug 2026, 04:21 WIB

CVE-2026-65642

CVE-2026-65642

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T21:21:41.122Z. Updated 2026-08-27T18:07:19.708Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 01:07 WIB

Official record

MedPublished 27 Aug 2026, 04:21 WIB

CVE-2026-58070

CVE-2026-58070

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T21:21:41.107Z. Updated 2026-08-27T15:04:11.211Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:04 WIB

Official record

HighPublished 27 Aug 2026, 04:21 WIB

CVE-2026-65647

CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T21:21:41.033Z. Updated 2026-08-27T17:59:51.351Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:59 WIB

Official record

CritPublished 27 Aug 2026, 04:21 WIB

CVE-2026-65641

CVE-2026-65641

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T21:21:40.955Z. Updated 2026-08-27T15:04:11.392Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:04 WIB

Official record

HighPublished 27 Aug 2026, 04:16 WIB

CVE-2026-77298

SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not permitted to hold. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T21:16:51.165Z. Updated 2026-08-27T14:17:48.966Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:17 WIB

Official record

HighPublished 27 Aug 2026, 04:07 WIB

CVE-2026-77368

SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their own token forbids. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T21:07:57.105Z. Updated 2026-08-27T14:32:40.158Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:32 WIB

Official record

LowPublished 27 Aug 2026, 04:05 WIB

CVE-2026-21809

HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input.

Excerpt language: en.

Severity low: primary CNA CVSS 3.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T21:05:16.937Z. Updated 2026-08-27T16:08:43.613Z.

CVSS3.9v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:08 WIB

Official record

LowPublished 27 Aug 2026, 03:48 WIB

CVE-2026-77573

Weblate: DNS rebinding in VCS operations allows server-side request forgery

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate validates the hostname's …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T20:48:48.146Z. Updated 2026-08-27T14:18:46.470Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:18 WIB

Official record

MedPublished 27 Aug 2026, 03:45 WIB

CVE-2026-77507

Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and restricted components. On …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T20:45:23.951Z. Updated 2026-08-27T15:19:25.959Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:19 WIB

Official record

HighPublished 27 Aug 2026, 03:42 WIB

CVE-2026-15973

LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled data. The value is stored in the surveymenu_entries.data fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T20:42:44.008Z. Updated 2026-08-27T14:23:20.858Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

MedPublished 27 Aug 2026, 03:36 WIB

CVE-2026-62326

Weblate Has Uncontrolled Resource Consumption via

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny servic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T20:36:25.043Z. Updated 2026-08-27T13:52:30.709Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 20:52 WIB

Official record

MedPublished 27 Aug 2026, 03:29 WIB

CVE-2026-62249

Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T20:29:49.207Z. Updated 2026-08-27T14:32:50.121Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:32 WIB

Official record

HighPublished 27 Aug 2026, 03:26 WIB

CVE-2026-61792

Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T20:26:27.810Z. Updated 2026-08-29T02:51:38.553Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 09:51 WIB

Official record

HighPublished 27 Aug 2026, 03:24 WIB

CVE-2026-79921

amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T20:24:58.115Z. Updated 2026-08-29T02:50:25.822Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 09:50 WIB

Official record

MedPublished 27 Aug 2026, 03:23 WIB

CVE-2026-61790

Weblate: Team-enforced 2FA is bypassed for global permissions

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global permissions. As a result, a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T20:23:53.644Z. Updated 2026-08-27T14:51:14.305Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:51 WIB

Official record

HighPublished 27 Aug 2026, 03:14 WIB

CVE-2026-55228

Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T20:14:02.713Z. Updated 2026-08-27T15:20:40.892Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:20 WIB

Official record