Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1781–1800 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100675

stoatchat before 0.15.5 Denial of Service via mass mentions

stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:38.319Z. Updated 2026-09-28T18:07:41.284Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:07 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100674

stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1781 to 1800 of 14934.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:37.620Z. Updated 2026-09-30T14:58:59.656Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:58 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100673

Grav Data Manager before 1.4.5 Stored XSS via item-detail view

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cases after a striptags('<br>') call that PHP's strip_tags() bypasses by prese…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:36.898Z. Updated 2026-09-30T20:11:12.708Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100672

grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the vis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:36.168Z. Updated 2026-09-28T16:32:14.948Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:32 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100671

Grav before 2.0.25 Session Cookie Theft via Twig Sandbox

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:35.451Z. Updated 2026-09-28T18:12:07.848Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:12 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100670

Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as `access.admin.super` (instead of the nested `access[admin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:34.756Z. Updated 2026-09-30T14:57:47.995Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:57 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100669

Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config (IIS), every deny rule (user_sensitive_folders, user_accounts, user_data, user_error_redirect, user_pages, system, vendor, ignore_folders) sets ignoreCase="false" on it…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:34.082Z. Updated 2026-09-30T20:11:12.856Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100668

Grav before 2.0.25 Sandbox Escape via array Filter

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but is registered without the needs_is_sandboxed guard that print_r, vardump, json_encode, yaml_encode and string carry, and its implementation calls toArray() — or falls bac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:33.382Z. Updated 2026-09-28T16:31:25.182Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:31 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100667

grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass

grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:32.685Z. Updated 2026-09-28T18:14:51.902Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:14 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100666

Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:31.961Z. Updated 2026-09-30T14:54:46.509Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:54 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100665

Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:31.242Z. Updated 2026-10-02T15:46:37.467Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 22:46 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100664

Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3Fra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:30.478Z. Updated 2026-09-28T16:47:05.471Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:47 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100663

Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target (e.g., "CONNECT trusted.example:443") is parsed as a URI, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:29.751Z. Updated 2026-09-28T18:48:51.788Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:48 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100662

Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accept…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:28.990Z. Updated 2026-09-30T14:53:30.335Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:53 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100661

Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:28.303Z. Updated 2026-10-02T20:46:26.627Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated03 Oct 2026, 03:46 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100660

Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controlled QUIC stream ID, an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:27.554Z. Updated 2026-09-28T16:45:45.821Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:45 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100659

Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single HEADERS frame contain…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:26.859Z. Updated 2026-09-28T18:17:29.170Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:17 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100654

vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:23.312Z. Updated 2026-09-30T14:51:39.132Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:51 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100653

vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and spe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:22.605Z. Updated 2026-10-01T11:06:45.139Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 18:06 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100652

vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tens…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:21.865Z. Updated 2026-09-28T16:42:13.668Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:42 WIB

Official record