Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1681–1700 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100854

AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:46.412Z. Updated 2026-10-08T15:22:03.450Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100853

AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1681 to 1700 of 14934.First page Next page

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:45.749Z. Updated 2026-09-28T13:25:48.092Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:25 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100852

AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger comm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:45.077Z. Updated 2026-09-28T16:10:26.151Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:10 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100851

AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this endpoint and receive…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:44.349Z. Updated 2026-09-30T15:20:33.536Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:20 WIB

Official record

MedPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100850

AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist

AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl()). A user with the station Media permission can create or update a playlist with source=remote_url and remote_type=playl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:43.673Z. Updated 2026-09-30T15:54:40.858Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:54 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100849

AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (backend/src/Webhook/Connector/AbstractConnector.php), used by the Generic and Discord webhook connectors, rejects only URLs whose host is a literal link-local IP add…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:42.974Z. Updated 2026-09-28T13:57:34.821Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:57 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100848

AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri) and performs no host or IP address restriction. A user holding only the station-scoped RemoteRelays perm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:42.329Z. Updated 2026-09-28T16:38:16.249Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:38 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100847

AzuraCast before 0.23.8 DQL Injection via sortOrder

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settings.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:41.653Z. Updated 2026-09-30T15:19:13.811Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:19 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100846

MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:41.003Z. Updated 2026-10-08T15:22:02.692Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100845

MONAI before 1.6.0 Remote Code Execution via NumpyReader

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI's standard data p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:40.337Z. Updated 2026-09-28T13:56:50.879Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:56 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100844

MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:39.672Z. Updated 2026-10-08T15:22:02.046Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100843

MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:38.803Z. Updated 2026-09-30T15:17:39.080Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:17 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100842

MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains

MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval(). Expressions bui…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:38.149Z. Updated 2026-09-30T16:54:11.393Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:54 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100841

MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache

In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:37.499Z. Updated 2026-09-28T13:56:03.312Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:56 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100840

MONAI through 1.6.0 Remote Code Execution via bundle configuration

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python eval(). Attackers can publish a malicious bundle with crafted configuration containing arbitrary …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:36.821Z. Updated 2026-09-28T16:46:00.366Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:46 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100839

Contrast before 1.18.0 AML Injection Remote Code Execution

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack ("BadAML"). ACPI tables containing AML bytecode are passed from the untrusted host (QEMU) to the guest firmware (OVMF) and on to the Linux kernel, whose A…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:36.154Z. Updated 2026-10-08T15:22:01.430Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100838

Contrast before 1.19.1 CopyFile Policy Symlink Subversion

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to connect to the Kata ag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:35.498Z. Updated 2026-10-08T15:22:00.652Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

CritPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100835

Contrast before 1.16.0 Remote Attestation Relay Attack

Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically truste…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:33.471Z. Updated 2026-09-30T15:16:05.311Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:16 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100834

http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:32.781Z. Updated 2026-09-30T17:03:58.285Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:03 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100833

Contrast before 1.23.1 Image Substitution via Policy Generation

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage entries using the `image_guest_pull` driver without verifying t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:32.099Z. Updated 2026-10-09T13:22:54.929Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated09 Oct 2026, 20:22 WIB

Official record