Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1681–1700 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116808

OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:38.546Z. Updated 2026-10-26T23:05:38.546Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

HighPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116807

OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all proj…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1681 to 1700 of 16156.First page Next page

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:37.872Z. Updated 2026-10-26T23:05:37.872Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116806

OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a member session to obta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:37.220Z. Updated 2026-10-26T23:05:37.220Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116805

OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling off…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:36.532Z. Updated 2026-10-27T14:15:58.367Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:15 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:35.850Z. Updated 2026-10-26T23:05:35.850Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116803

DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:35.135Z. Updated 2026-10-26T23:05:35.135Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116802

DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeNa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:34.457Z. Updated 2026-10-26T23:05:34.457Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116801

Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:33.735Z. Updated 2026-10-27T14:16:07.428Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:16 WIB

Official record

MedPublished 27 Oct 2026, 06:05 WIB

CVE-2026-116800

WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:05:33.044Z. Updated 2026-10-26T23:05:33.044Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:05 WIB

Official record

MedPublished 27 Oct 2026, 06:00 WIB

CVE-2026-116602

SourceCodester Online Food Ordering System delete.php unlink path traversal

A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T23:00:08.972Z. Updated 2026-10-26T23:00:08.972Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:00 WIB

Official record

MedPublished 27 Oct 2026, 05:45 WIB

CVE-2026-116556

Argilla TextField.vue cross site scripting

A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The manipulation of the argument text results in cross site scripting. The attack can be executed remotely. The exploit has been made …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T22:45:06.821Z. Updated 2026-10-27T14:16:13.865Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:16 WIB

Official record

MedPublished 27 Oct 2026, 05:30 WIB

CVE-2026-116555

Argilla Sandbox.vue cross site scripting

A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the attack is possible. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T22:30:16.499Z. Updated 2026-10-26T22:30:16.499Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 05:30 WIB

Official record

MedPublished 27 Oct 2026, 05:30 WIB

CVE-2026-2270

StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T22:30:02.445Z. Updated 2026-10-29T10:45:47.863Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

MedPublished 27 Oct 2026, 05:29 WIB

CVE-2026-76654

Subpath symlinking on Windows nodes permits NTLM coercion

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T22:29:23.944Z. Updated 2026-10-26T23:10:47.018Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 06:10 WIB

Official record

MedPublished 27 Oct 2026, 05:15 WIB

CVE-2026-116554

Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting

A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be lau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T22:15:08.212Z. Updated 2026-10-26T22:15:08.212Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 05:15 WIB

Official record

MedPublished 27 Oct 2026, 05:00 WIB

CVE-2026-116515

itsourcecode Online Book Store book.php sql injection

A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T22:00:17.488Z. Updated 2026-10-27T14:16:22.247Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:16 WIB

Official record

HighPublished 27 Oct 2026, 04:54 WIB

CVE-2026-116591

compress zstd: Panic on two-block frames

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:54:33.109Z. Updated 2026-10-27T14:16:30.395Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:16 WIB

Official record

HighPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116748

Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-don…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:45.799Z. Updated 2026-10-26T21:52:45.799Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

CritPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116747

Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:45.058Z. Updated 2026-10-26T21:52:45.058Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116746

QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:44.250Z. Updated 2026-10-27T14:16:39.214Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:16 WIB

Official record