Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1541–1560 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 27 Aug 2026, 00:08 WIB

CVE-2026-47837

Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T17:08:51.832Z. Updated 2026-08-26T18:50:49.428Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:50 WIB

Official record

HighPublished 27 Aug 2026, 00:05 WIB

CVE-2026-47836

Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1541 to 1560 of 12259.First page Next page

Published 2026-08-26T17:05:21.979Z. Updated 2026-08-27T03:58:24.390Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 10:58 WIB

Official record

HighPublished 26 Aug 2026, 23:49 WIB

CVE-2026-32258

Winter: Stored XSS through Editor Settings custom styles

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T16:49:06.852Z. Updated 2026-08-26T17:35:11.529Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:35 WIB

Official record

HighPublished 26 Aug 2026, 23:45 WIB

CVE-2026-32257

Winter: Stored XSS through Brand Settings custom styles

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T16:45:12.100Z. Updated 2026-08-27T14:33:49.017Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:33 WIB

Official record

HighPublished 26 Aug 2026, 23:40 WIB

CVE-2026-35445

Winter: Authenticated backend users can bypass Users controller permission checks

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T16:40:51.500Z. Updated 2026-08-26T19:08:44.974Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 02:08 WIB

Official record

HighPublished 26 Aug 2026, 22:45 WIB

CVE-2026-81036

Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that requirement is false in the sh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:45:02.931Z. Updated 2026-08-29T02:45:24.847Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 09:45 WIB

Official record

HighPublished 26 Aug 2026, 22:45 WIB

CVE-2026-81035

Midday Missing Owner Check on Team Deletion

Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls re-checks the same helper …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:45:02.234Z. Updated 2026-08-26T16:06:39.105Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 23:06 WIB

Official record

HighPublished 26 Aug 2026, 22:45 WIB

CVE-2026-81034

Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No configuration value govern…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:45:01.529Z. Updated 2026-08-26T18:31:47.883Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:31 WIB

Official record

MedPublished 26 Aug 2026, 22:45 WIB

CVE-2026-81033

Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:45:00.826Z. Updated 2026-08-28T16:00:31.483Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 23:00 WIB

Official record

CritPublished 26 Aug 2026, 22:45 WIB

CVE-2026-81032

NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:45:00.144Z. Updated 2026-08-26T17:10:45.206Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:10 WIB

Official record

HighPublished 26 Aug 2026, 22:44 WIB

CVE-2026-81031

IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:44:59.362Z. Updated 2026-08-29T02:43:32.712Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 09:43 WIB

Official record

HighPublished 26 Aug 2026, 22:44 WIB

CVE-2026-81030

Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpoint

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling FileContentResource and FileRe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:44:58.663Z. Updated 2026-08-26T16:05:12.110Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 23:05 WIB

Official record

HighPublished 26 Aug 2026, 22:44 WIB

CVE-2026-81029

OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer servlet later formats t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:44:57.988Z. Updated 2026-10-20T01:46:57.584Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated20 Oct 2026, 08:46 WIB

Official record

MedPublished 26 Aug 2026, 22:44 WIB

CVE-2026-81028

ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision

ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The configuration loader in server/WebApi.cpp builds each root with File::absolutePath("", item, true); because the relative-path argument is empty that helper return…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:44:57.303Z. Updated 2026-10-27T10:14:36.984Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

HighPublished 26 Aug 2026, 22:44 WIB

CVE-2026-81027

one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the caller, while the path-para…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:44:56.599Z. Updated 2026-08-26T17:25:39.276Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:25 WIB

Official record

CritPublished 26 Aug 2026, 22:44 WIB

CVE-2026-80428

ILIAS PHP Object Injection via Shibboleth Logout

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:44:55.917Z. Updated 2026-09-30T16:39:08.178Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:39 WIB

Official record

HighPublished 26 Aug 2026, 22:44 WIB

CVE-2026-80427

bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:44:55.220Z. Updated 2026-08-29T11:48:06.751Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

HighPublished 26 Aug 2026, 22:44 WIB

CVE-2026-80426

FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the neighbouring info value…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:44:54.517Z. Updated 2026-08-29T11:48:06.089Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

MedPublished 26 Aug 2026, 22:37 WIB

CVE-2026-48549

Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a cur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:37:20.083Z. Updated 2026-08-28T16:00:44.978Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 23:00 WIB

Official record

MedPublished 26 Aug 2026, 22:33 WIB

CVE-2026-48548

Nagios Core CSRF via cmd.cgi

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:33:59.685Z. Updated 2026-08-26T17:29:31.213Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:29 WIB

Official record