Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1661–1680 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 27 Oct 2026, 06:29 WIB

CVE-2026-111422

Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed on the remote SSH host. In a Dag that passes trigger-time in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:29:30.363Z. Updated 2026-10-29T10:38:09.290Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:38 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116828

YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1661 to 1680 of 16156.First page Next page

Published 2026-10-26T23:05:52.662Z. Updated 2026-10-26T23:05:52.662Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116827

YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:51.992Z. Updated 2026-10-26T23:05:51.992Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116826

YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:51.286Z. Updated 2026-10-27T14:15:19.006Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:15 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116825

YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo ac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:50.597Z. Updated 2026-10-26T23:05:50.597Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116824

YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:49.898Z. Updated 2026-10-26T23:05:49.898Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116823

YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback

YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue() falls back to unsanitized $_REQUEST values rendered via Twig |r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:49.182Z. Updated 2026-10-26T23:05:49.182Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116822

YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter

YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:48.458Z. Updated 2026-10-27T14:15:27.706Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:15 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116821

YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:47.763Z. Updated 2026-10-26T23:05:47.763Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116820

YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:47.054Z. Updated 2026-10-26T23:05:47.054Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116819

OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and author…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:46.288Z. Updated 2026-10-26T23:05:46.288Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116818

OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:45.602Z. Updated 2026-10-27T14:15:35.476Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:15 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116817

OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore healt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:44.806Z. Updated 2026-10-26T23:05:44.806Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116815

OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:44.097Z. Updated 2026-10-26T23:05:44.097Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116814

OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:43.404Z. Updated 2026-10-26T23:05:43.404Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116813

OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:41.783Z. Updated 2026-10-27T14:15:43.266Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:15 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116812

OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or com…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:41.107Z. Updated 2026-10-26T23:05:41.107Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116811

OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker proc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:40.470Z. Updated 2026-10-26T23:05:40.470Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116810

OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:39.854Z. Updated 2026-10-26T23:05:39.854Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116809

OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:39.208Z. Updated 2026-10-27T14:15:52.170Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:15 WIB

Official record