Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1501–1520 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 27 Oct 2026, 19:25 WIB

CVE-2026-114409

Docker Desktop logs can expose stored third-party credentials

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account toke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:25:57.894Z. Updated 2026-10-27T12:25:57.894Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:25 WIB

Official record

LowPublished 27 Oct 2026, 19:24 WIB

CVE-2026-107590

Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1501 to 1520 of 16156.First page Next page

Severity low: primary CNA CVSS 1.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:24:53.005Z. Updated 2026-10-27T12:24:53.005Z.

CVSS1.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:24 WIB

Official record

HighPublished 27 Oct 2026, 19:17 WIB

CVE-2026-47486

CVE-2026-47486

NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, information disclosure.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:17:18.717Z. Updated 2026-10-29T10:45:47.441Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

CritPublished 27 Oct 2026, 19:16 WIB

CVE-2026-65145

CVE-2026-65145

NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:16:45.287Z. Updated 2026-10-27T12:16:45.287Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:16 WIB

Official record

HighPublished 27 Oct 2026, 19:16 WIB

CVE-2026-65151

CVE-2026-65151

NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:16:44.388Z. Updated 2026-10-27T12:16:44.388Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:16 WIB

Official record

HighPublished 27 Oct 2026, 19:15 WIB

CVE-2026-65120

CVE-2026-65120

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:15:07.629Z. Updated 2026-10-27T12:15:07.629Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:15 WIB

Official record

HighPublished 27 Oct 2026, 19:15 WIB

CVE-2026-24269

CVE-2026-24269

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:15:06.731Z. Updated 2026-10-27T12:15:06.731Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:15 WIB

Official record

HighPublished 27 Oct 2026, 19:15 WIB

CVE-2026-65119

CVE-2026-65119

NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information disclosure, data tampering, and denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:15:05.891Z. Updated 2026-10-27T12:15:05.891Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:15 WIB

Official record

HighPublished 27 Oct 2026, 19:03 WIB

CVE-2026-100164

User Enumeration in Rolantis Information Technologies' Agentis

Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T12:03:27.458Z. Updated 2026-10-27T12:03:27.458Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 19:03 WIB

Official record

HighPublished 27 Oct 2026, 18:56 WIB

CVE-2026-106087

CVE-2026-106087

TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:56:54.738Z. Updated 2026-10-27T11:56:54.738Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 18:56 WIB

Official record

HighPublished 27 Oct 2026, 18:56 WIB

CVE-2026-10756

CVE-2026-10756

TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive funct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:56:05.906Z. Updated 2026-10-27T11:56:05.906Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 18:56 WIB

Official record

MedPublished 27 Oct 2026, 18:55 WIB

CVE-2026-115408

ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets

In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key pair by `CKA_ID`/`CKA_LABEL` and never verify it against the private key. In additi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:55:15.600Z. Updated 2026-10-27T11:55:15.600Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 18:55 WIB

Official record

HighPublished 27 Oct 2026, 18:50 WIB

CVE-2026-13162

CVE-2026-13162

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. Whe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:50:44.803Z. Updated 2026-10-27T11:50:44.803Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 18:50 WIB

Official record

MedPublished 27 Oct 2026, 18:43 WIB

CVE-2026-113644

iofogctl command injection via Controller provisioning response

In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:43:28.824Z. Updated 2026-10-27T11:43:28.824Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 18:43 WIB

Official record

MedPublished 27 Oct 2026, 18:39 WIB

CVE-2026-90728

CVE-2026-90728

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high privileged attacker with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:39:36.832Z. Updated 2026-10-29T10:45:47.578Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

MedPublished 27 Oct 2026, 18:39 WIB

CVE-2026-105323

Reflected XSS in Kulga Software's Kulga News Software

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS. This issue affects Kulga News Software: from v26.7.4 before v26.10.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:39:34.238Z. Updated 2026-10-27T11:39:34.238Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 18:39 WIB

Official record

MedPublished 27 Oct 2026, 18:35 WIB

CVE-2026-90729

CVE-2026-90729

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high privileged attacker with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:35:11.026Z. Updated 2026-10-29T10:45:47.717Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

CritPublished 27 Oct 2026, 18:34 WIB

CVE-2026-115216

Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials

In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:34:47.619Z. Updated 2026-10-27T11:34:47.619Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 18:34 WIB

Official record

MedPublished 27 Oct 2026, 18:32 WIB

CVE-2026-41022

CVE-2026-41022

Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:32:04.448Z. Updated 2026-10-27T11:32:04.448Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 18:32 WIB

Official record

MedPublished 27 Oct 2026, 18:32 WIB

CVE-2026-10752

Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T11:32:04.243Z. Updated 2026-10-29T01:52:00.370Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:52 WIB

Official record