Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1481–1500 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 27 Oct 2026, 20:08 WIB

CVE-2026-117569

Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters

Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:08:01.873Z. Updated 2026-10-27T13:08:01.873Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:08 WIB

Official record

HighPublished 27 Oct 2026, 20:08 WIB

CVE-2026-117568

mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or director…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1481 to 1500 of 16156.First page Next page

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:08:01.183Z. Updated 2026-10-28T16:16:50.835Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:16 WIB

Official record

HighPublished 27 Oct 2026, 20:08 WIB

CVE-2026-117567

esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters

esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_na…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:08:00.469Z. Updated 2026-10-27T13:08:00.469Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:08 WIB

Official record

MedPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117566

EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the serve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:59.767Z. Updated 2026-10-27T13:07:59.767Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

MedPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117565

Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch

Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:59.080Z. Updated 2026-10-27T13:07:59.080Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

CritPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117564

nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or cla…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:58.360Z. Updated 2026-10-28T16:16:56.709Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:16 WIB

Official record

MedPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117563

MrDoc through 1.1.1 Broken Access Control via manage_doc_share

MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:57.656Z. Updated 2026-10-27T13:07:57.656Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

MedPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117562

rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint

rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:56.982Z. Updated 2026-10-27T13:07:56.982Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

HighPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117561

sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values

Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:56.281Z. Updated 2026-10-27T13:07:56.281Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

HighPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117560

ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:55.594Z. Updated 2026-10-28T16:17:06.328Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:17 WIB

Official record

HighPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117559

DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:53.788Z. Updated 2026-10-27T13:07:53.788Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

HighPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117558

ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status

The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:53.099Z. Updated 2026-10-27T13:07:53.099Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

MedPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117557

SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader

SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:52.419Z. Updated 2026-10-27T13:07:52.419Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

MedPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117556

zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap head…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:51.708Z. Updated 2026-10-28T16:17:15.487Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:17 WIB

Official record

MedPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117555

GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()

CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:51.020Z. Updated 2026-10-27T13:07:51.020Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

MedPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117554

Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:50.357Z. Updated 2026-10-27T13:07:50.357Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

HighPublished 27 Oct 2026, 20:07 WIB

CVE-2026-117553

Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning

Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T13:07:49.671Z. Updated 2026-10-27T13:07:49.671Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:07 WIB

Official record

HighPublished 27 Oct 2026, 19:58 WIB

CVE-2026-92546

Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally

Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:58:42.332Z. Updated 2026-10-27T12:58:42.332Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:58 WIB

Official record

UnscoredPublished 27 Oct 2026, 19:45 WIB

CVE-2026-116627

CVE-2026-116627

Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notif…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:45:34.223Z. Updated 2026-10-27T12:45:34.223Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:45 WIB

Official record

MedPublished 27 Oct 2026, 19:32 WIB

CVE-2026-15586

OTP Brute-Force Account Takeover in Idvlabs Software's Ontime

Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Consulting Services Inc. Ontime allows Brute Force. This issue affects Ontime: through 2026-10-27. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:32:04.384Z. Updated 2026-10-27T12:32:04.384Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:32 WIB

Official record