Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 1661–1680 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

CritPublished 27 May 2026, 03:00 WIB

CVE-2026-44449

Lumiverse: SMB `exists()` basename injection via smbclient `!cmd` escape

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, when the primary toSmbPath(fullPath) call throws, the method falls back to a dirname/basename split and only validates the directory prefix. The basename is concatenated directly into the smbclient -c script without validation. smbclient interprets ; as …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T20:00:12.090Z. Updated 2026-05-27T13:22:34.992Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 20:22 WIB

Official record

CritPublished 27 May 2026, 02:58 WIB

CVE-2026-44451

Lumiverse: TSX component sandbox escape via DOM ref and string-split identifier bypass

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the component override system transpiles user-supplied TSX via Sucrase and evaluates it with new Function, shadowing dangerous globals (fetch, window, eval, etc.) with undefined. A static source validator (validateComponentOverrideSource) additionally bl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1661 to 1680 of 6933.First page Next page

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:58:37.036Z. Updated 2026-05-27T17:26:08.217Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 00:26 WIB

Official record

CritPublished 27 May 2026, 02:54 WIB

CVE-2026-44450

Lumiverse: RCE via MCP stdio argument injection

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary names but forwards the args array to the child process without any validation. Every binary on the allowlist accepts an inline-code execution flag (-e for node/bu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:54:33.944Z. Updated 2026-06-01T17:09:40.653Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 00:09 WIB

Official record

MedPublished 27 May 2026, 02:49 WIB

CVE-2026-44844

eml_parser: Recursion DoS via nested message/rfc822 attachments

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.1, EmlParser.get_raw_body_text() recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who can supply a badly …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:49:45.723Z. Updated 2026-05-27T13:41:33.306Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated27 May 2026, 20:41 WIB

Official record

HighPublished 27 May 2026, 02:47 WIB

CVE-2026-44843

LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists

LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects="all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:47:35.328Z. Updated 2026-05-27T14:07:03.564Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 21:07 WIB

Official record

MedPublished 27 May 2026, 02:46 WIB

CVE-2026-48592

Missing authorization check on save-job event handler in oban_web

Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution. The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:46:48.611Z. Updated 2026-05-27T15:41:23.434Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 May 2026, 22:41 WIB

Official record

MedPublished 27 May 2026, 02:46 WIB

CVE-2026-48593

Unbounded range expansion in cron describe causes memory exhaustion in oban_web

Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unbounded cron range expansion. An attacker with access to schedule cron jobs can submit a malicious cron expression such as "0 0 1-100000000 * *". When a user with dashboard access vie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:46:43.980Z. Updated 2026-05-27T15:40:57.317Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated27 May 2026, 22:40 WIB

Official record

MedPublished 27 May 2026, 02:45 WIB

CVE-2026-9579

JeecgBoot SysUser userEdit user.getUsername access control

A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component SysUser. The manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:45:09.078Z. Updated 2026-05-27T14:01:29.812Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 May 2026, 21:01 WIB

Official record

MedPublished 27 May 2026, 02:43 WIB

CVE-2026-44836

view_component: Preview Route Can Dispatch Inherited Helper Methods

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly define…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:43:58.008Z. Updated 2026-05-27T13:21:54.259Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 20:21 WIB

Official record

MedPublished 27 May 2026, 02:40 WIB

CVE-2026-44837

view_component: System Test Entry Point Path Check Allows Sibling Directory Escape

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:40:47.661Z. Updated 2026-05-28T14:04:27.716Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 21:04 WIB

Official record

HighPublished 27 May 2026, 02:36 WIB

CVE-2026-8676

CVE-2026-8676

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:36:53.947Z. Updated 2026-05-26T20:47:58.785Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 03:47 WIB

Official record

MedPublished 27 May 2026, 02:34 WIB

CVE-2026-44214

eventsource-encoder: SSE event injection via unsanitized event and id fields

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Events line terminators (\…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:34:32.273Z. Updated 2026-05-27T13:19:45.558Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 20:19 WIB

Official record

MedPublished 27 May 2026, 02:32 WIB

CVE-2026-25426

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.0.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:32:38.371Z. Updated 2026-05-27T10:42:37.078Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 17:42 WIB

Official record

MedPublished 27 May 2026, 02:31 WIB

CVE-2026-24520

WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability

Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:31:35.457Z. Updated 2026-05-27T10:42:51.509Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 17:42 WIB

Official record

MedPublished 27 May 2026, 02:30 WIB

CVE-2026-44833

Snipe-IT: Open redirect vulnerability

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:30:48.852Z. Updated 2026-05-27T14:21:12.573Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 21:21 WIB

Official record

MedPublished 27 May 2026, 02:30 WIB

CVE-2026-25444

WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:30:14.887Z. Updated 2026-05-27T10:43:05.630Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 17:43 WIB

Official record

MedPublished 27 May 2026, 02:30 WIB

CVE-2026-9575

itsourcecode Student Transcript Processing System index.php sql injection

A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This issue affects some unknown processing of the file /admin/modules/class/index.php?view=view. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:30:12.092Z. Updated 2026-05-27T13:18:41.841Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 May 2026, 20:18 WIB

Official record

HighPublished 27 May 2026, 02:29 WIB

CVE-2026-44832

Snipe-IT: Privilege Escalation via API Permissions Assignment

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, al…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:29:31.026Z. Updated 2026-07-02T14:48:03.288Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Jul 2026, 21:48 WIB

Official record

MedPublished 27 May 2026, 02:29 WIB

CVE-2026-27331

WordPress WpTravelly plugin <= 2.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpTravelly: from n/a through 2.1.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:29:09.970Z. Updated 2026-05-27T10:43:19.687Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 17:43 WIB

Official record

MedPublished 27 May 2026, 02:27 WIB

CVE-2026-44831

Snipe-IT: XSS vulnerability in component notes

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T19:27:16.856Z. Updated 2026-05-27T16:08:45.980Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 23:08 WIB

Official record