Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1541–1560 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

CritPublished 28 Sep 2026, 11:45 WIB

CVE-2026-101000

Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the attack remotely. The explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T04:45:11.474Z. Updated 2026-10-01T14:05:47.584Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:05 WIB

Official record

MedPublished 28 Sep 2026, 11:30 WIB

CVE-2026-100909

OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1541 to 1560 of 14934.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T04:30:10.101Z. Updated 2026-09-28T12:48:33.093Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:48 WIB

Official record

HighPublished 28 Sep 2026, 11:15 WIB

CVE-2026-100908

Eyeplus p2pcam HTTP stack-based overflow

A vulnerability has been found in Eyeplus 57.0.0.0308. This affects an unknown function of the component p2pcam HTTP Parser. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T04:15:11.336Z. Updated 2026-09-28T12:35:49.807Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:35 WIB

Official record

MedPublished 28 Sep 2026, 11:02 WIB

CVE-2026-87723

Untrusted Search Path (PATH Hijacking) in fuse-archive

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T04:02:14.738Z. Updated 2026-09-29T15:00:09.522Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:00 WIB

Official record

MedPublished 28 Sep 2026, 11:00 WIB

CVE-2026-100907

Eyeplus p2pcam Service snapshot information disclosure

A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the file /snapshot of the component p2pcam Service. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T04:00:10.780Z. Updated 2026-10-01T14:04:43.881Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:04 WIB

Official record

MedPublished 28 Sep 2026, 10:45 WIB

CVE-2026-100906

Eyeplus ONVIF Device GetUsers information disclosure

A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation results in information disclosure. The attack can be executed remotely. The exploit is now public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T03:45:09.786Z. Updated 2026-09-28T12:47:50.064Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:47 WIB

Official record

MedPublished 28 Sep 2026, 10:30 WIB

CVE-2026-100904

amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting

A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argument itemName leads to cr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T03:30:10.816Z. Updated 2026-09-28T12:40:08.652Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:40 WIB

Official record

MedPublished 28 Sep 2026, 10:15 WIB

CVE-2026-100903

ООО НПО Ритм GEOritm REST API obj-groups missing authentication

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and migh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T03:15:11.496Z. Updated 2026-10-01T14:03:25.159Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:03 WIB

Official record

HighPublished 28 Sep 2026, 10:00 WIB

CVE-2026-100902

Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of input

A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper Upload. This manipulation of the argument wallpaper causes improper validation of syntactic correctness of input. The attack can be in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T03:00:08.244Z. Updated 2026-09-28T18:35:10.382Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:35 WIB

Official record

MedPublished 28 Sep 2026, 09:45 WIB

CVE-2026-100901

athlon1600 youtube-downloader stream.php stream server-side request forgery

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and cou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T02:45:10.743Z. Updated 2026-09-28T12:46:00.957Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:46 WIB

Official record

MedPublished 28 Sep 2026, 09:30 WIB

CVE-2026-100900

DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery

A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function updateJiraProjects of the file /jira-import of the component Jira Import. The manipulation of the argument host/username/token leads to server-side request forgery. It is possible to initiate …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T02:30:09.844Z. Updated 2026-10-01T14:00:55.894Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:00 WIB

Official record

MedPublished 28 Sep 2026, 09:15 WIB

CVE-2026-100899

DevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injection

A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This impacts the function whereRaw of the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the component Timesheet Dashboard. Executing a manipulation of the argument filter can lead to sql injection. The attack may be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T02:15:16.991Z. Updated 2026-09-28T12:57:16.594Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:57 WIB

Official record

MedPublished 28 Sep 2026, 09:00 WIB

CVE-2026-100898

DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection

A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the component Timesheet Dashboard. Performing a manipulation of the argument filter results in sql injection. The atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T02:00:13.363Z. Updated 2026-09-28T12:52:22.741Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:52 WIB

Official record

MedPublished 28 Sep 2026, 08:45 WIB

CVE-2026-100897

fuzui StudentInfo Password Change Endpoint moditypasswordstu authorization

A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impacted element is an unknown function of the file /StudentInfo/StudentHandler/moditypasswordstu of the component Password Change Endpoint. Such manipulation of the argument sid/tid leads to authorizatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T01:45:08.084Z. Updated 2026-10-01T13:58:59.344Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:58 WIB

Official record

CritPublished 28 Sep 2026, 08:30 WIB

CVE-2026-100896

TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection

A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os command injection. Remote exploitation of the attack is possible. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T01:30:14.267Z. Updated 2026-09-28T12:56:46.536Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:56 WIB

Official record

MedPublished 28 Sep 2026, 08:15 WIB

CVE-2026-100895

Trusted Domain Project OpenARC libopenarc arc-canon.c arc_parse_canon_t null pointer dereference

A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_parse_canon_t in the library libopenarc/arc-canon.c of the component libopenarc. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T01:15:11.424Z. Updated 2026-09-28T13:00:11.969Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:00 WIB

Official record

MedPublished 28 Sep 2026, 08:00 WIB

CVE-2026-100894

mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. The exploit is publicly a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T01:00:13.301Z. Updated 2026-10-01T13:57:31.706Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:57 WIB

Official record

MedPublished 28 Sep 2026, 07:45 WIB

CVE-2026-100893

Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_graph::fetch of the file src/api/resource.rs of the component open_graphic_parse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T00:45:15.919Z. Updated 2026-09-28T12:56:10.518Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:56 WIB

Official record

MedPublished 28 Sep 2026, 07:30 WIB

CVE-2026-100892

aligungr UERANSIM nr-gnb handler.cpp ULInformationTransfer memory corruption

A vulnerability was found in aligungr UERANSIM up to 3.3.0. This affects the function ULInformationTransfer of the file src/gnb/rrc/handler.cpp of the component nr-gnb. Performing a manipulation of the argument dedicatedNASMessage results in memory corruption. The attack can be initiated remotely. The exploit has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T00:30:09.114Z. Updated 2026-09-28T13:02:41.006Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:02 WIB

Official record

MedPublished 28 Sep 2026, 07:15 WIB

CVE-2026-100891

Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function opendmarc_policy_query_dmarc in the library libopendmarc/opendmarc_policy.c of the component Internationalized Domain Name Handler. Such manipulation leads to encoding error. It is possible to launch t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T00:15:14.678Z. Updated 2026-10-01T13:55:15.001Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:55 WIB

Official record