Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1721–1740 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116725

gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:28.842Z. Updated 2026-10-26T21:52:28.842Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

HighPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116724

FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow

FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1721 to 1740 of 16156.First page Next page

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:28.153Z. Updated 2026-10-26T21:52:28.153Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

HighPublished 27 Oct 2026, 04:52 WIB

CVE-2026-116723

FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field

FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:52:27.469Z. Updated 2026-10-26T21:52:27.469Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:52 WIB

Official record

MedPublished 27 Oct 2026, 04:48 WIB

CVE-2026-116590

snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:48:15.468Z. Updated 2026-10-26T21:48:15.468Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:48 WIB

Official record

MedPublished 27 Oct 2026, 04:45 WIB

CVE-2026-116514

itsourcecode Airline Reservation System book_flight.php cross site scripting

A weakness has been identified in itsourcecode Airline Reservation System 1.0. This affects an unknown part of the file /book_flight.php. Executing a manipulation of the argument max can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:45:14.583Z. Updated 2026-10-26T21:45:14.583Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:45 WIB

Official record

CritPublished 27 Oct 2026, 04:30 WIB

CVE-2026-116508

TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow

A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:30:18.376Z. Updated 2026-10-26T21:30:18.376Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:30 WIB

Official record

HighPublished 27 Oct 2026, 04:26 WIB

CVE-2026-116589

Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:26:58.832Z. Updated 2026-10-26T21:26:58.832Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:26 WIB

Official record

HighPublished 27 Oct 2026, 04:22 WIB

CVE-2026-116588

Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU cons…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:22:46.130Z. Updated 2026-10-26T21:22:46.130Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:22 WIB

Official record

MedPublished 27 Oct 2026, 04:15 WIB

CVE-2026-116507

TOTOLINK A950RG global.so getLanguageCfg information disclosure

A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:15:18.291Z. Updated 2026-10-27T14:17:44.541Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:17 WIB

Official record

HighPublished 27 Oct 2026, 04:12 WIB

CVE-2026-116587

Go JOSE: DoS when parsing JWKs that contain RSA keys

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enfo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:12:21.326Z. Updated 2026-10-27T14:17:50.939Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:17 WIB

Official record

MedPublished 27 Oct 2026, 04:09 WIB

CVE-2026-116586

Go JOSE: Panics in JSON parsing

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or object…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:09:26.349Z. Updated 2026-10-26T21:09:26.349Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:09 WIB

Official record

MedPublished 27 Oct 2026, 04:06 WIB

CVE-2026-116585

Go JOSE: Panic during CBC-HMAC processing

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS51…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:06:35.189Z. Updated 2026-10-26T21:06:35.189Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:06 WIB

Official record

CritPublished 27 Oct 2026, 04:00 WIB

CVE-2026-116506

TOTOLINK A950RG firewall.so apmib_set command injection

A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T21:00:16.563Z. Updated 2026-10-26T21:00:16.563Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 04:00 WIB

Official record

HighPublished 27 Oct 2026, 03:52 WIB

CVE-2026-116584

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines me…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T20:52:38.339Z. Updated 2026-10-26T20:52:38.339Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 03:52 WIB

Official record

MedPublished 27 Oct 2026, 03:49 WIB

CVE-2026-116583

Seroval: Code injection through a typed array's own constructor property

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T20:49:35.952Z. Updated 2026-10-27T14:18:01.418Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:18 WIB

Official record

MedPublished 27 Oct 2026, 03:46 WIB

CVE-2026-116582

Seroval: Script injection through RegExp sources in serialized output

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T20:46:46.069Z. Updated 2026-10-26T20:46:46.069Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 03:46 WIB

Official record

CritPublished 27 Oct 2026, 03:45 WIB

CVE-2026-116505

TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection

A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T20:45:18.066Z. Updated 2026-10-26T20:45:18.066Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 03:45 WIB

Official record

UnscoredPublished 27 Oct 2026, 03:44 WIB

CVE-2026-86925

CVE-2026-86925

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to access sensitive user data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T20:44:37.328Z. Updated 2026-10-29T13:00:13.783Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:00 WIB

Official record

UnscoredPublished 27 Oct 2026, 03:44 WIB

CVE-2026-84627

CVE-2026-84627

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2, visionOS 27. Processing a maliciously crafted image may lead to heap corruption.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T20:44:35.462Z. Updated 2026-10-26T20:44:35.462Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Oct 2026, 03:44 WIB

Official record

UnscoredPublished 27 Oct 2026, 03:44 WIB

CVE-2026-113945

CVE-2026-113945

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T20:44:34.502Z. Updated 2026-10-26T20:44:34.502Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Oct 2026, 03:44 WIB

Official record