Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1761–1780 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100695

Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:52.929Z. Updated 2026-09-28T17:45:53.936Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:45 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100694

Hugo before 0.166.0 Cross-Site Scripting via text/org

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. An attacker who can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1761 to 1780 of 14934.First page Next page

Published 2026-09-26T13:23:52.256Z. Updated 2026-09-30T15:05:16.280Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:05 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100693

Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:51.556Z. Updated 2026-09-30T17:05:28.149Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:05 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100692

Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:50.847Z. Updated 2026-09-28T16:30:24.018Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:30 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100691

Hugo before 0.166.0 Stored XSS via lineAnchors code block option

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option before passing it to Chroma, which writes the value verbatim into the `id` and `href` attributes of the generated line-number markup. A crafted `lineAnchors` value su…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:50.149Z. Updated 2026-09-28T17:51:34.652Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:51 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100690

Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that po…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:49.448Z. Updated 2026-09-30T15:04:40.978Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:04 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100689

GitPython before 3.1.62 Path Traversal via gitmodules path

GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the `name` field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:48.759Z. Updated 2026-10-08T15:21:59.548Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100688

Budibase server before 3.45.0 Cross-Tenant Information Disclosure

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrieve sensitive applicatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:48.061Z. Updated 2026-10-08T15:21:58.977Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100687

Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing table save or delete op…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:47.369Z. Updated 2026-10-08T15:21:58.454Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100686

Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in oth…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:46.674Z. Updated 2026-10-08T15:21:57.721Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100685

Budibase before 3.45.0 Information Disclosure via Chat Links

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:45.934Z. Updated 2026-10-08T15:21:56.885Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

CritPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100684

Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validating an invite code and wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:45.225Z. Updated 2026-10-08T15:21:56.292Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100683

Budibase before 3.45.0 SQL Injection via column-rename DDL

Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a single-quoted sp_rename literal for MSSQL) without applying the project's quoteMySqlIdentifier / quo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:44.523Z. Updated 2026-10-08T15:21:55.694Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100682

Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:43.846Z. Updated 2026-10-08T15:21:55.126Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100681

Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled ser…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:43.143Z. Updated 2026-10-08T15:21:54.188Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100680

Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:42.415Z. Updated 2026-10-08T15:21:53.575Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100679

stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:41.637Z. Updated 2026-09-28T18:03:01.169Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:03 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100678

stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:40.935Z. Updated 2026-09-30T15:00:30.440Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:00 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100677

stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:39.733Z. Updated 2026-09-30T17:38:09.594Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:38 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100676

stoatchat before 0.15.5 Local Filesystem Read via SVG

January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:39.014Z. Updated 2026-09-28T16:33:08.727Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:33 WIB

Official record