Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 1841–1860 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

CritPublished 22 Apr 2026, 00:15 WIB

CVE-2026-41193

FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validating file paths, allowing an authenticated admin to write files arbitrarily on the server filesystem via a specially crafted ZIP. Version 1.8.215 fixes the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:15:26.236Z. Updated 2026-04-21T20:36:59.036Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 03:36 WIB

Official record

MedPublished 22 Apr 2026, 00:14 WIB

CVE-2026-40594

pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py reads the X-Forwarded-Proto header from any HTTP request without validating that the request originates from a trusted proxy, then mutates…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1841 to 1860 of 5813.First page Next page

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:14:03.627Z. Updated 2026-04-21T18:01:30.556Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 01:01 WIB

Official record

HighPublished 22 Apr 2026, 00:12 WIB

CVE-2026-41192

FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment IDs. Any IDs present in `attachments_all[]` but omitted from retained lists are decrypted and passed directly to `Attachment::deleteByIds()`. Because `load_attachm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:12:42.628Z. Updated 2026-04-21T19:01:14.512Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:01 WIB

Official record

HighPublished 22 Apr 2026, 00:12 WIB

CVE-2026-40588

blueprintUE: Authenticated Password Change Does Not Verify Current Password

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{slug}/edit/ does not include a current_password field and does not verify the user's existing password before accepting a new one. Any attacker who obtains a valid authenticated session — through XSS exploitati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:12:08.938Z. Updated 2026-04-22T13:22:02.425Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 20:22 WIB

Official record

MedPublished 22 Apr 2026, 00:11 WIB

CVE-2026-40587

blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via the profile edit page, or when a password reset is completed via the reset link, neither operation invalidates existing authenticated sessions for that user. A server-side session store associates userID → ses…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:11:23.740Z. Updated 2026-04-21T20:37:05.304Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 03:37 WIB

Official record

HighPublished 22 Apr 2026, 00:10 WIB

CVE-2026-40586

blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-account attempt counter, no temporary lockout, no progressive delay (Tarpit), and n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:10:05.432Z. Updated 2026-04-21T19:04:41.220Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:04 WIB

Official record

HighPublished 22 Apr 2026, 00:09 WIB

CVE-2026-41191

FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, `MailboxesController::updateSave()` persists `chat_start_new` outside the allowed-field filter. A user with only the mailbox `sig` permission sees only the signature field in the UI, but can still change the hidden mailbox-wide chat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:09:26.481Z. Updated 2026-04-21T19:07:38.705Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:07 WIB

Official record

HighPublished 22 Apr 2026, 00:09 WIB

CVE-2026-40585

blueprintUE: Password Reset Tokens Have No Expiry Window

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password_reset_at timestamp. However, the token redemption function findUserIDFromEmailAndToken() queries only for a matching email + password_rese…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:09:17.982Z. Updated 2026-04-21T17:48:47.758Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:48 WIB

Official record

HighPublished 22 Apr 2026, 00:06 WIB

CVE-2026-41190

FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when `APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS` is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The `save_draft` AJAX path is weaker. A direct POST can create a draft inside a co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:06:31.785Z. Updated 2026-04-21T17:48:06.353Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:48 WIB

Official record

MedPublished 22 Apr 2026, 00:05 WIB

CVE-2026-40584

RansomLook - Improper Filtering of Private Location Entries in API Endpoints Leads to Information Exposure

RansomLook is a tool to monitor Ransomware groups and markets and extract their victims. Prior to 1.9.0, the API in the affected application improperly filters private location entries in website/web/api/genericapi.py. Because the code removes elements from a list while iterating over it, entries marked as private may …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:05:25.349Z. Updated 2026-04-21T17:29:55.759Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:29 WIB

Official record

HighPublished 22 Apr 2026, 00:04 WIB

CVE-2026-41189

FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, customer-thread editing is authorized through `ThreadPolicy::edit()`, which checks mailbox access but does not apply the assigned-only restriction from `ConversationPolicy`. A user who cannot view a conversation can still load and e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:04:07.469Z. Updated 2026-04-21T17:37:13.107Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:37 WIB

Official record

MedPublished 22 Apr 2026, 00:00 WIB

CVE-2026-41183

FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:00:39.033Z. Updated 2026-04-21T20:37:11.192Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 03:37 WIB

Official record

CritPublished 22 Apr 2026, 00:00 WIB

CVE-2026-21571

CVE-2026-21571

This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T17:00:05.524Z. Updated 2026-04-23T03:56:05.653Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated23 Apr 2026, 10:56 WIB

Official record

HighPublished 21 Apr 2026, 23:57 WIB

CVE-2026-40583

UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt

UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:57:42.100Z. Updated 2026-04-21T20:37:16.729Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated22 Apr 2026, 03:37 WIB

Official record

MedPublished 21 Apr 2026, 23:57 WIB

CVE-2026-40592

FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conversation/undo-reply/{thread_id}` checks only whether the current user can view the parent conversation. It does not verify that the current user created the reply being undone. In a shared mailbox, one …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:57:33.146Z. Updated 2026-04-21T19:10:40.989Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:10 WIB

Official record

HighPublished 21 Apr 2026, 23:54 WIB

CVE-2026-40591

FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the phone-conversation creation flow accepts attacker-controlled `customer_id`, `name`, `to_email`, and `phone` values and resolves the target customer in the backend without enforcing mailbox-scoped customer visibility. As a result…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:54:14.113Z. Updated 2026-04-21T17:46:38.202Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:46 WIB

Official record

MedPublished 21 Apr 2026, 23:52 WIB

CVE-2026-40590

FreeScout's Customer AJAX Create Modifies Hidden Existing Customer

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the Change Customer modal exposes a “Create a new customer” flow via POST /customers/ajax with action=create. Under limited visibility, the endpoint drops unique-email validation. If the supplied email already belongs to a hidden cu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:52:27.992Z. Updated 2026-04-21T17:39:21.865Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:39 WIB

Official record

HighPublished 21 Apr 2026, 23:50 WIB

CVE-2026-40589

FreeScout has Customer Edit Cross-Mailbox Email Takeover

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, a low-privileged agent can edit a visible customer and add an email address already owned by a hidden customer in another mailbox. The server discloses the hidden customer’s name and profile URL in the success flash, reassigns the h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:50:22.119Z. Updated 2026-04-21T20:37:22.372Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 03:37 WIB

Official record

CritPublished 21 Apr 2026, 23:48 WIB

CVE-2026-40050

CrowdStrike LogScale Unauthenticated Path Traversal

CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability (CVE-2026-40050) in LogScale. This vulnerability only requires mitigation by customers that host specific versions of LogScale and does not affect Next-Gen SIEM customers. The vulnerability exists in a specific …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:48:24.722Z. Updated 2026-04-21T17:25:29.299Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:25 WIB

Official record

MedPublished 21 Apr 2026, 23:48 WIB

CVE-2026-40570

FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` returns complete customer profile data to any authenticated user without verifying mailbox access. An attacker only needs a valid email address to retrieve all customer PI…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:48:08.260Z. Updated 2026-04-21T19:11:51.385Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:11 WIB

Official record