Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1801–1820 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100651

vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, vllm/entrypoints/serve/disagg/serving.py builds a multimodal EngineInput directly from the caller-supplied token_ids, and Genera…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:21.141Z. Updated 2026-09-28T18:25:40.222Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:25 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100650

vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths — the shared media-acquisition layer …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1801 to 1820 of 14934.First page Next page

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:20.418Z. Updated 2026-10-01T11:06:44.741Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 18:06 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100649

vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows independent counter increments. Unauthenticated attackers can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted G…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:19.687Z. Updated 2026-10-02T18:00:11.135Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated03 Oct 2026, 01:00 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100648

vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to bypass file size restrictions. Attackers can submit oversized audio files through chat endpoints to consume excessive memory and CPU resources during decoding.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:18.965Z. Updated 2026-09-28T16:40:42.006Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:40 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100647

vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP requests with multi-hundr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:18.240Z. Updated 2026-09-28T18:28:14.772Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:28 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100646

SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go) fail open when the HTTP Origin header is absent, on the incorrect assumption that any browser-in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:17.483Z. Updated 2026-09-30T14:47:14.800Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:47 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100645

SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js child_process AP…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:16.770Z. Updated 2026-10-08T15:51:27.580Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:51 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100644

SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:16.086Z. Updated 2026-10-08T15:51:26.948Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:51 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100643

SiYuan before v3.8.4 Stored XSS via Attribute View textarea

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:15.365Z. Updated 2026-09-28T18:32:45.015Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:32 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100642

SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel proces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:14.649Z. Updated 2026-09-30T14:45:54.559Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:45 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100641

SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content such as <img src=inval…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:13.957Z. Updated 2026-10-05T15:58:59.286Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 22:58 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100640

SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote renderer content can obta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:13.287Z. Updated 2026-10-27T01:30:30.357Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 08:30 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100639

SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:12.602Z. Updated 2026-09-28T18:51:14.199Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:51 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100638

SiYuan before v3.8.4 Path Traversal via setNotebookIcon

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook parameter to escape the wor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:11.930Z. Updated 2026-09-30T13:02:17.513Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:02 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100637

SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON files in pre-existing kern…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:11.226Z. Updated 2026-10-05T15:06:34.280Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 22:06 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100636

SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:10.528Z. Updated 2026-09-28T16:50:54.968Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:50 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100635

SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:09.854Z. Updated 2026-10-27T01:30:29.704Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 08:30 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100634

SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(), including windows be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:09.166Z. Updated 2026-10-08T15:51:25.360Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:51 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100633

SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations

SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPath(), invoked from resolvePath()) is applied only to the allowed root of recursive operations and not to each resolved descendant path — an incomplete fix for GHS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:08.505Z. Updated 2026-10-05T15:21:18.882Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100632

Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:07.825Z. Updated 2026-09-28T16:49:03.774Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:49 WIB

Official record