Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1701–1720 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116745

QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view book…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:43.567Z. Updated 2026-10-26T21:52:43.567Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116744

ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector

ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1701 to 1720 of 16156.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:42.875Z. Updated 2026-10-26T21:52:42.875Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116743

libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data

libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecf_url_values_read_data() that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknown_offset, crashing foren…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:42.185Z. Updated 2026-10-26T21:52:42.185Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116742

HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count

HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:41.511Z. Updated 2026-10-27T14:16:48.820Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:16 WIB

Official record

HighPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116741

Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:40.782Z. Updated 2026-10-26T21:52:40.782Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

HighPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116740

libcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser

libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:39.177Z. Updated 2026-10-26T21:52:39.177Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116739

VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:38.496Z. Updated 2026-10-26T21:52:38.496Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

HighPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116738

VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:37.804Z. Updated 2026-10-27T14:16:56.633Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:16 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116737

libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the proc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:37.080Z. Updated 2026-10-26T21:52:37.080Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116736

libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array

Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:36.380Z. Updated 2026-10-27T10:14:07.473Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116735

libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries

libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:35.680Z. Updated 2026-10-27T10:14:06.821Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116734

flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header

flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:34.998Z. Updated 2026-10-27T14:17:08.680Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:17 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116733

flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the bu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:34.304Z. Updated 2026-10-26T21:52:34.304Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116732

libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table

libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, dis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:33.622Z. Updated 2026-10-26T21:52:33.622Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116731

Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, cr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:32.953Z. Updated 2026-10-26T21:52:32.953Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116730

Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:32.251Z. Updated 2026-10-27T14:17:14.912Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:17 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116729

libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a

libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read past the heap b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:31.564Z. Updated 2026-10-26T21:52:31.564Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116728

libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024

libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage volume that makes libfvde_volume_open() copy past the heap bloc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:30.883Z. Updated 2026-10-26T21:52:30.883Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116727

gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c

gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:30.198Z. Updated 2026-10-26T21:52:30.198Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116726

gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title

Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:29.528Z. Updated 2026-10-27T14:17:32.379Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:17 WIB

Official record