Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1741–1760 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 26 Sep 2026, 20:24 WIB

CVE-2026-100715

Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped, and then executes '…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:24:07.174Z. Updated 2026-09-28T16:59:54.596Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:59 WIB

Official record

CritPublished 26 Sep 2026, 20:24 WIB

CVE-2026-100714

Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_regexp or required_otp guard, and its value is concatenated unescaped into the acme.sh command line built in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1741 to 1760 of 14934.First page Next page

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:24:06.446Z. Updated 2026-09-26T23:07:30.927Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 06:07 WIB

Official record

HighPublished 26 Sep 2026, 20:24 WIB

CVE-2026-100713

Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()/makeCorrectFile() is done only at check time; the live files…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:24:05.746Z. Updated 2026-09-26T23:10:14.884Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 06:10 WIB

Official record

HighPublished 26 Sep 2026, 20:24 WIB

CVE-2026-100712

froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g. /customer_index.php?page=2fa&action=delete), with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers POST/PUT/PATCH/DELET…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:24:05.047Z. Updated 2026-09-28T14:46:48.443Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 21:46 WIB

Official record

HighPublished 26 Sep 2026, 20:24 WIB

CVE-2026-100711

froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:24:04.358Z. Updated 2026-09-28T17:04:03.276Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:04 WIB

Official record

MedPublished 26 Sep 2026, 20:24 WIB

CVE-2026-100710

Froxlor before 2.3.12 DKIM Private Key Disclosure via API

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the panel_domains table and return the row unmodified, including the panel_domains.dkim_privkey field. An authe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:24:03.656Z. Updated 2026-09-26T23:07:53.011Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 06:07 WIB

Official record

HighPublished 26 Sep 2026, 20:24 WIB

CVE-2026-100709

Froxlor before 2.3.12 2FA Bypass via Namespace Confusion

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate name…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:24:02.908Z. Updated 2026-09-26T23:08:21.420Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 06:08 WIB

Official record

HighPublished 26 Sep 2026, 20:24 WIB

CVE-2026-100708

Froxlor before 2.3.13 Private Key Disclosure via Certificates API

Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domain_ssl_settings queries are passed through ApiCommand::response() without any…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:24:02.102Z. Updated 2026-09-28T14:49:50.160Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 21:49 WIB

Official record

HighPublished 26 Sep 2026, 20:24 WIB

CVE-2026-100707

Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and read resources from othe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:24:01.414Z. Updated 2026-09-28T17:41:14.708Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:41 WIB

Official record

CritPublished 26 Sep 2026, 20:24 WIB

CVE-2026-100706

kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:24:00.707Z. Updated 2026-09-26T23:08:54.549Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 06:08 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100705

Kyverno before 1.19.1 SSRF via legacy apiCall service executor

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legacy apiCall service exe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:59.999Z. Updated 2026-09-26T23:10:45.970Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 06:10 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100704

Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource causes image signature…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:59.326Z. Updated 2026-09-28T14:50:36.275Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 21:50 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100703

Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy namespace. A tenant who can create a namespaced policy (e.g. NamespacedV…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:58.666Z. Updated 2026-09-28T17:42:15.793Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:42 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100702

Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:57.945Z. Updated 2026-09-26T23:11:16.551Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 06:11 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100701

Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:57.215Z. Updated 2026-09-26T23:11:37.880Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 06:11 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100700

nodemailer before 10.0.6 Denial of Service via addressparser

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service un…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:56.526Z. Updated 2026-09-28T15:01:54.036Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 22:01 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100699

Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment

Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For exa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:55.786Z. Updated 2026-09-28T17:43:19.483Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:43 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100698

Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:55.058Z. Updated 2026-09-30T15:07:54.104Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:07 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100697

Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:54.288Z. Updated 2026-09-30T17:43:47.316Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:43 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100696

Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver

Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unauthenticated attacker …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:53.613Z. Updated 2026-09-28T16:28:42.083Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:28 WIB

Official record