Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 161–180 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

MedPublished 30 May 2026, 00:49 WIB

CVE-2026-44651

SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends: res.status(500).send('Error occurred while trying to proxy to: ' + url + ' ' + e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:49:19.494Z. Updated 2026-06-01T15:20:31.759Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:20 WIB

Official record

CritPublished 30 May 2026, 00:48 WIB

CVE-2026-44650

SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, POST /api/extensions/delete endpoint accepts extensionName: "." which bypasses sanitize-filename validation, causing the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 161 to 180 of 6933.First page Next page

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:48:03.396Z. Updated 2026-05-29T19:13:57.913Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 02:13 WIB

Official record

MedPublished 30 May 2026, 00:47 WIB

CVE-2026-40425

MacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External Parties

The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:47:17.918Z. Updated 2026-05-29T19:46:13.488Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 May 2026, 02:46 WIB

Official record

HighPublished 30 May 2026, 00:46 WIB

CVE-2026-44648

SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data (user handle, permissions) in a signed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:46:27.574Z. Updated 2026-05-29T19:47:10.723Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 02:47 WIB

Official record

CritPublished 30 May 2026, 00:45 WIB

CVE-2026-44649

SillyTavern: Authentication Bypass via SSO Header Injection

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern accepts Remote-User (Authelia) and X-Authentik-Username (Authentik) HTTP headers to automatically log in use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:45:26.073Z. Updated 2026-06-02T01:48:37.402Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 08:48 WIB

Official record

HighPublished 30 May 2026, 00:44 WIB

CVE-2026-42929

MacGregor Voyage Data Recorder (VDR) G4e Use of Hard-coded Credentials

Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:44:48.753Z. Updated 2026-05-29T19:45:30.368Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 May 2026, 02:45 WIB

Official record

MedPublished 30 May 2026, 00:43 WIB

CVE-2026-44652

SillyTavern: SSRF vulnerability in the CORS proxy middleware

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, corsProxyMiddleware forwards req.params.url directly into fetch(url, ...). It only blocks circular requests to its own h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:43:07.425Z. Updated 2026-05-29T21:40:54.065Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 May 2026, 04:40 WIB

Official record

MedPublished 30 May 2026, 00:42 WIB

CVE-2026-44611

MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational Effort

Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:42:15.577Z. Updated 2026-05-29T19:44:47.782Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated30 May 2026, 02:44 WIB

Official record

HighPublished 30 May 2026, 00:41 WIB

CVE-2026-46372

SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern exposes /api/search/searxng, which accepts attacker-controlled baseUrl and uses it directly to build outboun…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:41:58.146Z. Updated 2026-05-29T19:44:04.613Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 02:44 WIB

Official record

MedPublished 30 May 2026, 00:32 WIB

CVE-2026-42951

MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials

An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:32:11.492Z. Updated 2026-05-29T19:43:09.533Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated30 May 2026, 02:43 WIB

Official record

HighPublished 30 May 2026, 00:27 WIB

CVE-2026-42941

MacGregor Voyage Data Recorder (VDR) G4e Use of Default Credentials

The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:27:29.153Z. Updated 2026-05-29T19:42:06.839Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 May 2026, 02:42 WIB

Official record

CritPublished 30 May 2026, 00:18 WIB

CVE-2026-45668

Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:18:28.997Z. Updated 2026-05-29T19:23:26.469Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated30 May 2026, 02:23 WIB

Official record

HighPublished 30 May 2026, 00:14 WIB

CVE-2026-44697

Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node fr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:14:43.465Z. Updated 2026-07-21T19:50:26.647Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated22 Jul 2026, 02:50 WIB

Official record

CritPublished 30 May 2026, 00:11 WIB

CVE-2026-7786

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and used to authenticate to device services.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:11:33.184Z. Updated 2026-05-29T19:31:38.170Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 02:31 WIB

Official record

CritPublished 30 May 2026, 00:10 WIB

CVE-2026-45625

Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps source repositories and their stored credentials. Eight of those endpoints (…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:10:57.210Z. Updated 2026-06-01T15:21:59.466Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:21 WIB

Official record

MedPublished 30 May 2026, 00:10 WIB

CVE-2026-45626

Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter

Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitiser blocks ../ tra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:10:22.582Z. Updated 2026-06-01T22:35:13.407Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 05:35 WIB

Official record

HighPublished 30 May 2026, 00:08 WIB

CVE-2026-45627

Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> el…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:08:53.797Z. Updated 2026-05-29T17:31:14.391Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 00:31 WIB

Official record

HighPublished 30 May 2026, 00:07 WIB

CVE-2026-47125

Arcane: Missing admin authorization on global variables endpoint

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin authorization check. Any a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:07:21.675Z. Updated 2026-06-01T15:22:41.648Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:22 WIB

Official record

HighPublished 30 May 2026, 00:06 WIB

CVE-2026-47179

Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because ProjectService.CreateProject wr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:06:34.169Z. Updated 2026-06-02T15:46:26.827Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 22:46 WIB

Official record

HighPublished 29 May 2026, 23:58 WIB

CVE-2026-5768

Fourth Frontier Frontier X Mobile Application, Frontier X2 Missing Authentication for Critical Function

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities, triggering vibrations, causi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T16:58:02.035Z. Updated 2026-05-29T19:31:52.111Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 02:31 WIB

Official record