Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 1761–1780 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 24 Mar 2026, 21:42 WIB

CVE-2026-4775

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a deni…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T14:42:47.529Z. Updated 2026-10-02T02:05:32.800Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated02 Oct 2026, 09:05 WIB

Official record

HighPublished 24 Mar 2026, 21:13 WIB

CVE-2026-27651

NGINX ngx_mail_auth_http_module vulnerability

When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Not…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1761 to 1780 of 6236.First page Next page

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T14:13:27.295Z. Updated 2026-07-15T01:13:39.490Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:13 WIB

Official record

HighPublished 24 Mar 2026, 21:13 WIB

CVE-2026-27654

NGINX ngx_http_dav_module vulnerability

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T14:13:26.879Z. Updated 2026-07-15T01:13:37.047Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:13 WIB

Official record

MedPublished 24 Mar 2026, 21:13 WIB

CVE-2026-28755

NGINX ngx_stream_ssl_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T14:13:26.502Z. Updated 2026-03-24T15:24:16.108Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:24 WIB

Official record

MedPublished 24 Mar 2026, 21:13 WIB

CVE-2026-28753

NGINX ngx_mail_proxy_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T14:13:26.107Z. Updated 2026-03-24T15:24:34.995Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:24 WIB

Official record

HighPublished 24 Mar 2026, 21:13 WIB

CVE-2026-32647

NGINX ngx_http_mp4_module vulnerability

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T14:13:25.724Z. Updated 2026-07-15T01:07:50.616Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:07 WIB

Official record

HighPublished 24 Mar 2026, 21:13 WIB

CVE-2026-27784

NGINX ngx_http_mp4_module vulnerability

The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T14:13:25.343Z. Updated 2026-07-15T01:12:57.824Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:12 WIB

Official record

HighPublished 24 Mar 2026, 20:25 WIB

CVE-2026-33418

@dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection

DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T13:25:57.540Z. Updated 2026-03-24T15:11:51.489Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:11 WIB

Official record

MedPublished 24 Mar 2026, 20:23 WIB

CVE-2026-33311

@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options

DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribute values derived from user-supplied options (`backgroundColor`, `fontFamily`, `textColor`) were not XML-escaped before interpolation into SVG output. This could …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T13:23:43.289Z. Updated 2026-03-26T13:06:31.409Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:06 WIB

Official record

HighPublished 24 Mar 2026, 20:17 WIB

CVE-2026-33310

Intake has a Command Injection via shell() Expansion in Parameter Defaults

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be execu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T13:17:38.572Z. Updated 2026-03-24T15:36:17.300Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:36 WIB

Official record

HighPublished 24 Mar 2026, 20:14 WIB

CVE-2026-33497

Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T13:14:39.647Z. Updated 2026-03-24T17:45:26.314Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Mar 2026, 00:45 WIB

Official record

HighPublished 24 Mar 2026, 19:57 WIB

CVE-2026-33484

Langflow has Unauthenticated IDOR on Image Downloads

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image wit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T12:57:33.641Z. Updated 2026-03-24T13:37:14.286Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 20:37 WIB

Official record

CritPublished 24 Mar 2026, 19:54 WIB

CVE-2026-33475

Langflow GitHub Actions Shell Injection

Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables (e.g., `${{ github.head_ref }}`) in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T12:54:33.369Z. Updated 2026-03-25T03:55:45.997Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated25 Mar 2026, 10:55 WIB

Official record

CritPublished 24 Mar 2026, 19:49 WIB

CVE-2026-33309

Langflow has an Arbitrary File Write (RCE) via v2 API

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage layer lacks…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T12:49:16.276Z. Updated 2026-03-25T03:55:47.098Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated25 Mar 2026, 10:55 WIB

Official record

UnscoredPublished 24 Mar 2026, 19:30 WIB

CVE-2026-4721

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firef…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T12:30:44.312Z. Updated 2026-07-15T00:49:07.514Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jul 2026, 07:49 WIB

Official record

UnscoredPublished 24 Mar 2026, 19:30 WIB

CVE-2026-4729

Memory safety bugs fixed in Firefox 149 and Thunderbird 149

Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T12:30:43.835Z. Updated 2026-07-15T00:49:02.863Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jul 2026, 07:49 WIB

Official record

UnscoredPublished 24 Mar 2026, 19:30 WIB

CVE-2026-4720

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T12:30:43.271Z. Updated 2026-07-15T00:49:09.776Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jul 2026, 07:49 WIB

Official record

UnscoredPublished 24 Mar 2026, 19:30 WIB

CVE-2026-4719

Incorrect boundary conditions in the Graphics: Text component

Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T12:30:42.762Z. Updated 2026-04-13T13:51:15.420Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 20:51 WIB

Official record

UnscoredPublished 24 Mar 2026, 19:30 WIB

CVE-2026-4718

Undefined behavior in the WebRTC: Signaling component

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T12:30:42.279Z. Updated 2026-04-13T13:51:12.032Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 20:51 WIB

Official record

UnscoredPublished 24 Mar 2026, 19:30 WIB

CVE-2026-4728

Spoofing issue in the Privacy: Anti-Tracking component

Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T12:30:41.773Z. Updated 2026-04-13T13:51:10.061Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 20:51 WIB

Official record