Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1601–1620 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101056

Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:38.060Z. Updated 2026-10-08T15:22:09.212Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

LowPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101051

Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations within accessible namespaces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1601 to 1620 of 14934.First page Next page

Published 2026-09-27T17:02:37.358Z. Updated 2026-09-28T14:06:18.432Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 21:06 WIB

Official record

MedPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101048

Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrator with only the Admin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:36.546Z. Updated 2026-10-08T15:22:07.489Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

MedPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101047

Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:35.852Z. Updated 2026-09-30T14:47:15.528Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:47 WIB

Official record

LowPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101046

Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause wit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:35.154Z. Updated 2026-09-28T13:16:02.557Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:16 WIB

Official record

HighPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101045

Fleet Homebrew Cask OS Command Injection via Metadata

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters (for example $(...) command subst…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:34.472Z. Updated 2026-09-30T17:20:13.569Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101044

pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias

pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied lockfile using --tru…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:33.798Z. Updated 2026-09-30T15:29:02.862Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:29 WIB

Official record

HighPublished 28 Sep 2026, 00:02 WIB

CVE-2026-101043

pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T17:02:33.119Z. Updated 2026-09-30T15:47:12.588Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:47 WIB

Official record

HighPublished 27 Sep 2026, 23:43 WIB

CVE-2026-88778

TCP Initial Sequence Number (ISN) prediction

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T16:43:16.503Z. Updated 2026-09-29T16:35:06.769Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:35 WIB

Official record

HighPublished 27 Sep 2026, 23:37 WIB

CVE-2026-88777

Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T16:37:44.345Z. Updated 2026-09-29T21:01:24.942Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 04:01 WIB

Official record

HighPublished 27 Sep 2026, 23:36 WIB

CVE-2026-88776

Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T16:36:40.034Z. Updated 2026-09-29T16:06:45.542Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:06 WIB

Official record

HighPublished 27 Sep 2026, 23:28 WIB

CVE-2026-101050

Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T16:28:28.766Z. Updated 2026-09-28T13:14:37.706Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:14 WIB

Official record

HighPublished 27 Sep 2026, 23:28 WIB

CVE-2026-101049

Heym before 0.0.53 Slack Webhook Signature Verification Bypass

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T16:28:28.128Z. Updated 2026-09-28T14:18:44.096Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 21:18 WIB

Official record

HighPublished 27 Sep 2026, 23:28 WIB

CVE-2026-101042

Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity

Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo) verify the client's authorization code with the external provider on signup an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T16:28:27.452Z. Updated 2026-09-30T15:28:02.845Z.

CVSS7.4v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

HighPublished 27 Sep 2026, 23:21 WIB

CVE-2026-88775

Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictabl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T16:21:12.160Z. Updated 2026-09-29T15:15:39.206Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:15 WIB

Official record

CritPublished 27 Sep 2026, 23:20 WIB

CVE-2026-88773

HTTP Request Smuggling

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T16:20:08.382Z. Updated 2026-09-29T15:21:44.819Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:21 WIB

Official record

HighPublished 27 Sep 2026, 23:14 WIB

CVE-2026-88774

Feature policy bypass due to improper HTTP URL based expression usage

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T16:14:02.993Z. Updated 2026-09-29T15:24:29.082Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:24 WIB

Official record

CritKEVPublished 27 Sep 2026, 23:09 WIB

CVE-2026-88772

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

Excerpt language: en.

Severity critical: primary CNA CVSS 9.5 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2026-09-27T16:09:56.033Z. Updated 2026-09-28T03:55:42.777Z.

CVSS9.5v4.0KEVListedEPSSPresentUpdated28 Sep 2026, 10:55 WIB

Official record

CritKEVPublished 27 Sep 2026, 23:02 WIB

CVE-2026-88771

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.5 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2026-09-27T16:02:07.001Z. Updated 2026-09-29T03:55:15.090Z.

CVSS9.5v4.0KEVListedEPSSPresentUpdated29 Sep 2026, 10:55 WIB

Official record

MedPublished 27 Sep 2026, 21:47 WIB

CVE-2026-101041

Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover

The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then consumed (cleared) it …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T14:47:57.012Z. Updated 2026-09-29T15:28:11.374Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:28 WIB

Official record