Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 1781–1800 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

MedPublished 26 May 2026, 22:54 WIB

CVE-2025-36220

Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.

IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T15:54:13.769Z. Updated 2026-05-26T17:38:43.369Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 00:38 WIB

Official record

MedPublished 26 May 2026, 22:52 WIB

CVE-2025-36126

IBM Cognos Analytics is affected by Cross-site scripting.

IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1781 to 1800 of 6933.First page Next page

Published 2026-05-26T15:52:49.002Z. Updated 2026-05-27T17:20:14.707Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 00:20 WIB

Official record

MedPublished 26 May 2026, 22:51 WIB

CVE-2025-36148

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.15 IBM Financial Transaction Manager SWIFT is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T15:51:52.671Z. Updated 2026-05-27T13:43:42.530Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 20:43 WIB

Official record

MedPublished 26 May 2026, 22:50 WIB

CVE-2025-36145

Multiple Vulnerabilities in watsonx.data

IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and outbound connections which could allow an attacker to transfer or modify files without restrictions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T15:50:54.945Z. Updated 2026-05-26T17:42:05.425Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 00:42 WIB

Official record

MedPublished 26 May 2026, 22:49 WIB

CVE-2025-14290

IBM webMethods Integration Sever is vulnerable to server-side request forgery

IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enum…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T15:49:23.780Z. Updated 2026-05-26T18:40:31.423Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 01:40 WIB

Official record

MedPublished 26 May 2026, 22:49 WIB

CVE-2026-44723

Vowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner

Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script run_tests_model_gen_and_load.py. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T15:49:17.951Z. Updated 2026-05-28T13:58:23.038Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:58 WIB

Official record

MedPublished 26 May 2026, 22:46 WIB

CVE-2025-13755

IBM® Db2® is vulnerable to credential exposure in db2diag when executing specific testcase buckets

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in log files that could be read by a local user.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T15:46:55.171Z. Updated 2026-05-26T17:51:09.240Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 00:51 WIB

Official record

MedPublished 26 May 2026, 22:45 WIB

CVE-2026-9562

sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard access control

A vulnerability has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The affected element is an unknown function of the component Dashboard. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T15:45:09.914Z. Updated 2026-05-28T14:33:57.183Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 May 2026, 21:33 WIB

Official record

MedPublished 26 May 2026, 22:04 WIB

CVE-2026-46620

e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()

e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T15:04:32.092Z. Updated 2026-05-27T16:04:41.864Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 23:04 WIB

Official record

HighPublished 26 May 2026, 22:01 WIB

CVE-2026-43935

e107: Host Header Injection in e107 password reset enables phishing

e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains. This can lead to phishing attacks, account takeover, or other security risk…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T15:01:36.720Z. Updated 2026-05-26T15:49:36.185Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated26 May 2026, 22:49 WIB

Official record

MedPublished 26 May 2026, 21:54 WIB

CVE-2026-43934

e107: Broken Access Control in e107 comment edit allows cross-user comment modification

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T14:54:21.210Z. Updated 2026-05-26T17:40:51.812Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 00:40 WIB

Official record

HighPublished 26 May 2026, 21:52 WIB

CVE-2026-25112

CVE-2026-25112

A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T14:52:37.064Z. Updated 2026-06-09T07:13:23.052Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated09 Jun 2026, 14:13 WIB

Official record

MedPublished 26 May 2026, 21:51 WIB

CVE-2026-43936

e107: Server-Side Request Forgery (SSRF) in the remote file fetcher

e107 is a content management system (CMS). Prior to 2.3.4, you can access the local environment by specifying the URL of the local environment from "Image/File URL:" of "From a remote location" in "Media Manager" on the administrator screen. This vulnerability is fixed in 2.3.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T14:51:49.317Z. Updated 2026-05-26T16:21:18.449Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated26 May 2026, 23:21 WIB

Official record

UnscoredPublished 26 May 2026, 21:38 WIB

CVE-2026-40564

Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator

Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files from the operator …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T14:38:21.937Z. Updated 2026-06-02T14:12:08.938Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Jun 2026, 21:12 WIB

Official record

CritKEVPublished 26 May 2026, 21:15 WIB

CVE-2026-45247

Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native un…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2026-05-26T14:15:33.596Z. Updated 2026-06-04T03:55:44.156Z.

CVSS9.3v4.0KEVListedEPSSPresentUpdated04 Jun 2026, 10:55 WIB

Official record

HighPublished 26 May 2026, 21:08 WIB

CVE-2026-46368

luci-app-https-dns-proxy Authenticated Command Injection via setInitAction

luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dn…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T14:08:51.764Z. Updated 2026-07-14T21:32:56.384Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 04:32 WIB

Official record

HighPublished 26 May 2026, 21:08 WIB

CVE-2026-42785

OpenKM 6.3.12 Remote Code Execution via Administrative Scripting

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T14:08:51.032Z. Updated 2026-05-26T16:20:15.493Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 23:20 WIB

Official record

HighPublished 26 May 2026, 21:08 WIB

CVE-2026-42425

OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T14:08:50.343Z. Updated 2026-05-26T15:14:09.128Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 22:14 WIB

Official record

MedPublished 26 May 2026, 21:08 WIB

CVE-2026-41917

OpenKM 6.3.12 Local File Inclusion via Admin Scripting

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to acce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T14:08:49.680Z. Updated 2026-05-27T16:08:59.835Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 May 2026, 23:08 WIB

Official record

MedPublished 26 May 2026, 21:08 WIB

CVE-2026-41401

libyang - Heap Use-After-Free Write in XML Metadata Parsing

libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted YANG XML documents with specific metadata attributes to appl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-26T14:08:48.973Z. Updated 2026-05-26T17:58:08.114Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 May 2026, 00:58 WIB

Official record