Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,616 published records · 20 KEV · 4,616 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,616 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3317.2%
High1,42031%
Med1,98843%
Low2104.5%
None360.78%
Legacy00.00%
Unscored63114%

Matching records by UTC month

Feb 264,616

Signal coverage

KEV-listed: 20
With a forecast: 4,616
Unknown date: 0
Unscored severity: 631

Share of cohort: KEV 0.43% · forecast 100% · unscored 14%.

Showing 181–200 of 4,616By severity band: Critical · 9.0–10.0 331, High · 7.0–8.9 1,420, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 210, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 631

CritPublished 27 Feb 2026, 07:36 WIB

CVE-2026-24663

Copeland XWEB and XWEB Pro OS Command Injection

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.

Excerpt language: en.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:36:49.215Z. Updated 2026-03-02T18:53:35.434Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 01:53 WIB

Official record

CritPublished 27 Feb 2026, 07:34 WIB

CVE-2026-21718

Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm

An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:34:55.895Z. Updated 2026-03-02T18:58:23.373Z.

Showing 181 to 200 of 4616.First page Next page

CVSS10v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 01:58 WIB

Official record

HighPublished 27 Feb 2026, 07:33 WIB

CVE-2026-25085

Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value

A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:33:06.657Z. Updated 2026-03-02T18:58:50.355Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 01:58 WIB

Official record

HighPublished 27 Feb 2026, 07:32 WIB

CVE-2026-3273

Tenda F453 httpd AdvSetWrlsafeset formWrlsafeset buffer overflow

A vulnerability was identified in Tenda F453 1.0.0.3. Affected by this vulnerability is the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component httpd. Such manipulation of the argument mit_ssid_index leads to buffer overflow. The attack can be executed remotely. The exploit is publicly availab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:32:09.615Z. Updated 2026-03-02T19:00:02.747Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated03 Mar 2026, 02:00 WIB

Official record

MedPublished 27 Feb 2026, 07:25 WIB

CVE-2026-22878

Mobility46 mobility46.se Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:25:23.952Z. Updated 2026-03-05T20:12:12.296Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:12 WIB

Official record

MedPublished 27 Feb 2026, 07:23 WIB

CVE-2026-27647

Mobility46 mobility46.se Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:23:50.315Z. Updated 2026-04-08T15:05:12.471Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 22:05 WIB

Official record

HighPublished 27 Feb 2026, 07:22 WIB

CVE-2026-26305

Mobility46 mobility46.se Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:22:24.167Z. Updated 2026-04-08T15:04:47.837Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 22:04 WIB

Official record

CritPublished 27 Feb 2026, 07:20 WIB

CVE-2026-27028

Mobility46 mobility46.se Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive O…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:20:52.288Z. Updated 2026-04-08T15:04:09.928Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 22:04 WIB

Official record

UnscoredPublished 27 Feb 2026, 07:16 WIB

CVE-2021-4456

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to lever…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:16:36.383Z. Updated 2026-02-27T16:53:23.671Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 23:53 WIB

Official record

MedPublished 27 Feb 2026, 07:15 WIB

CVE-2026-25774

EV Energy ev.energy Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:15:14.924Z. Updated 2026-04-08T15:03:34.669Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 22:03 WIB

Official record

MedPublished 27 Feb 2026, 07:13 WIB

CVE-2026-26290

EV Energy ev.energy Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:13:16.357Z. Updated 2026-03-31T14:20:41.450Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:20 WIB

Official record

HighPublished 27 Feb 2026, 07:11 WIB

CVE-2026-24445

EV Energy ev.energy Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:11:15.055Z. Updated 2026-03-31T14:20:24.074Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:20 WIB

Official record

CritPublished 27 Feb 2026, 07:09 WIB

CVE-2026-27772

EV Energy ev.energy Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive O…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:09:12.986Z. Updated 2026-03-05T20:45:17.841Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:45 WIB

Official record

MedPublished 27 Feb 2026, 07:03 WIB

CVE-2026-27773

SWITCH EV swtchenergy.com Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:03:43.458Z. Updated 2026-03-05T20:46:14.581Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:46 WIB

Official record

MedPublished 27 Feb 2026, 07:02 WIB

CVE-2026-25778

SWITCH EV swtchenergy.com Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:02:20.479Z. Updated 2026-03-05T20:28:34.280Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:28 WIB

Official record

HighPublished 27 Feb 2026, 07:02 WIB

CVE-2026-3272

Tenda F453 httpd DhcpListClient fromDhcpListClient buffer overflow

A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be ut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:02:12.958Z. Updated 2026-02-27T17:19:02.067Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:19 WIB

Official record

HighPublished 27 Feb 2026, 07:02 WIB

CVE-2026-3271

Tenda F453 httpd P2pListFilterof fromP2pListFilter buffer overflow

A vulnerability was found in Tenda F453 1.0.0.3. This impacts the function fromP2pListFilter of the file /goform/P2pListFilterof of the component httpd. The manipulation of the argument page results in buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:02:09.718Z. Updated 2026-02-27T17:25:44.383Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:25 WIB

Official record

UnscoredPublished 27 Feb 2026, 07:00 WIB

CVE-2025-69437

CVE-2025-69437

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can be triggered, resultin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:00:00.000Z. Updated 2026-02-27T19:47:56.667Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Feb 2026, 02:47 WIB

Official record

UnscoredPublished 27 Feb 2026, 07:00 WIB

CVE-2026-26861

CVE-2026-26861

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, which can be bypassed by an attacker usin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:00:00.000Z. Updated 2026-02-27T19:42:58.097Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Feb 2026, 02:42 WIB

Official record

UnscoredPublished 27 Feb 2026, 07:00 WIB

CVE-2026-26862

CVE-2026-26862

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includes() method to verify the originUrl contains "dashboard.clevertap.com", w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T00:00:00.000Z. Updated 2026-02-27T19:39:16.900Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Feb 2026, 02:39 WIB

Official record