Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1581–1600 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 28 Sep 2026, 03:49 WIB

CVE-2026-101085

Nezha before 2.3.8 Denial of Service via Alert Rule

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint to crash the dashboard p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T20:49:57.376Z. Updated 2026-09-28T13:47:18.879Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:47 WIB

Official record

CritPublished 28 Sep 2026, 03:49 WIB

CVE-2026-101084

obot before v0.21.1 Authorization Bypass via /mcp-connect

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using st…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1581 to 1600 of 14934.First page Next page

Published 2026-09-27T20:49:56.702Z. Updated 2026-09-30T22:12:50.861Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 05:12 WIB

Official record

CritPublished 28 Sep 2026, 03:49 WIB

CVE-2026-101065

Obot Quickstart Docker Deployment Unauthenticated Admin Access

Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the container listening on 0.0.0.0:8080 with authentication disabled by default. When authentication is disabled, every request is mapped to a synthetic "nobody…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T20:49:56.009Z. Updated 2026-09-30T17:20:14.254Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 28 Sep 2026, 03:49 WIB

CVE-2026-101064

Obot before v0.23.0 Server-Side Request Forgery via MCP

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T20:49:55.344Z. Updated 2026-09-28T13:01:29.785Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:01 WIB

Official record

MedPublished 28 Sep 2026, 03:49 WIB

CVE-2026-101063

Obot before v0.23.0 Authentication Bypass via Registry API

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T20:49:54.677Z. Updated 2026-09-28T13:49:35.081Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:49 WIB

Official record

HighPublished 28 Sep 2026, 03:49 WIB

CVE-2026-101062

Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already logged-in user with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T20:49:54.008Z. Updated 2026-09-30T22:11:52.618Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 05:11 WIB

Official record

MedPublished 28 Sep 2026, 03:45 WIB

CVE-2026-100879

zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T20:45:08.786Z. Updated 2026-09-30T22:10:01.362Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 05:10 WIB

Official record

MedPublished 28 Sep 2026, 03:30 WIB

CVE-2026-100878

zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds leads to authorization byp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T20:30:05.937Z. Updated 2026-09-28T13:02:07.739Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:02 WIB

Official record

HighPublished 28 Sep 2026, 03:19 WIB

CVE-2026-96280

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T20:19:12.890Z. Updated 2026-10-27T04:08:51.767Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 11:08 WIB

Official record

MedPublished 28 Sep 2026, 03:15 WIB

CVE-2026-100877

mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting

A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file registrationform.php. Executing a manipulation of the argument FName/LName/Addrs can lead to cross site scripting. The attack c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T20:15:09.305Z. Updated 2026-09-28T13:53:13.147Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:53 WIB

Official record

MedPublished 28 Sep 2026, 02:49 WIB

CVE-2026-96279

Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T19:49:17.239Z. Updated 2026-09-28T13:56:44.250Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:56 WIB

Official record

MedPublished 28 Sep 2026, 02:45 WIB

CVE-2026-100876

mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication

A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent.php. Performing a manipulation of the argument umail results in missing authentication. Remote exploitation of the attack is possible. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T19:45:08.814Z. Updated 2026-09-30T22:09:00.964Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 05:09 WIB

Official record

MedPublished 28 Sep 2026, 02:00 WIB

CVE-2026-100875

mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection. The attack may be launched remotely. The exploit has been d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T19:00:09.111Z. Updated 2026-09-28T13:02:44.005Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:02 WIB

Official record

MedPublished 28 Sep 2026, 01:30 WIB

CVE-2026-100874

mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file addnewstudent.php. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T18:30:07.193Z. Updated 2026-09-28T13:58:39.743Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:58 WIB

Official record

MedPublished 28 Sep 2026, 01:00 WIB

CVE-2026-100873

mathurvishal CloudClassroom-PHP-Project cross-site request forgery

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be used. This product does n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T18:00:15.506Z. Updated 2026-09-30T22:07:34.849Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 05:07 WIB

Official record

LowPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101061

utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugin performs no URL valid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:41.556Z. Updated 2026-09-30T14:14:29.298Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:14 WIB

Official record

HighPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101060

python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:40.832Z. Updated 2026-09-28T13:11:32.149Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:11 WIB

Official record

HighPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101059

utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's cl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:40.181Z. Updated 2026-09-28T14:02:40.274Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 21:02 WIB

Official record

HighPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101058

python-utcp before 1.1.12 SSRF via Remote HTTP Manual

python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensure_secure_url intentionally permits loopback HTTP for local development an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:39.400Z. Updated 2026-09-30T22:06:29.482Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 05:06 WIB

Official record

LowPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101057

utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL

utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensure_secure_url validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template naming a plain-HTT…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:38.721Z. Updated 2026-09-30T15:38:21.693Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:38 WIB

Official record