Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 1861–1880 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

CritPublished 21 Apr 2026, 23:46 WIB

CVE-2026-40569

FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration

FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a mass assignment vulnerability in the mailbox connection settings endpoints of FreeScout (`connectionIncomingSave()` at `app/Http/Controllers/MailboxesController.php:468` and `connectionOutgoingSave()` at line 398). Both metho…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:46:15.796Z. Updated 2026-04-21T17:45:31.659Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:45 WIB

Official record

CritPublished 21 Apr 2026, 23:35 WIB

CVE-2026-40576

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-server

excel-mcp-server is a Model Context Protocol server for Excel file manipulation. A path traversal vulnerability exists in excel-mcp-server versions up to and including 0.1.7. When running in SSE or Streamable-HTTP transport mode (the documented way to use this server remotely), an unauthenticated attacker on the networ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1861 to 1880 of 5813.First page Next page

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:35:15.592Z. Updated 2026-04-21T16:50:25.987Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated21 Apr 2026, 23:50 WIB

Official record

CritPublished 21 Apr 2026, 23:33 WIB

CVE-2026-5652

Authorization Bypass Through User-Controlled Key in Crafty Controller

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.

Excerpt language: en.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:33:56.878Z. Updated 2026-04-21T17:22:27.276Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:22 WIB

Official record

MedPublished 21 Apr 2026, 23:32 WIB

CVE-2026-40574

OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Prior to 7.15.2, an authorization bypass exists in OAuth2 Proxy as part of the email_domain enforcement option. An attacker may be able to authenticate with an email claim such as attacker@evil.com@company.com and satisfy an allowed do…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:32:34.537Z. Updated 2026-04-21T20:37:28.072Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 03:37 WIB

Official record

MedPublished 21 Apr 2026, 23:30 WIB

CVE-2026-6743

WebSystems WebTOTUM Calendar cross site scripting

A vulnerability has been found in WebSystems WebTOTUM 2026. This impacts an unknown function of the component Calendar. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading the affected component is recommended. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:30:14.358Z. Updated 2026-04-21T17:59:15.584Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:59 WIB

Official record

LowPublished 21 Apr 2026, 23:29 WIB

CVE-2026-40279

BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes using signed left shifts. When any of the four bytes has bit 7 set (value ≥ 0x80), the left-shift operation overflows a s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:29:16.125Z. Updated 2026-04-21T19:18:58.492Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:18 WIB

Official record

HighPublished 21 Apr 2026, 23:26 WIB

CVE-2026-40161

Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:26:27.381Z. Updated 2026-05-21T21:20:13.227Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated22 May 2026, 04:20 WIB

Official record

MedPublished 21 Apr 2026, 23:22 WIB

CVE-2026-35451

Twenty: Stored XSS via BlockNote FileBlock

Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting (XSS) vulnerability exists in the BlockNote editor component. Due to a lack of protocol validation in the FileBlock component and insufficient server-side inspection of block content, an attacker can inject a javascript: URI into the url prope…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:22:30.378Z. Updated 2026-04-21T16:56:02.097Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated21 Apr 2026, 23:56 WIB

Official record

LowPublished 21 Apr 2026, 23:19 WIB

CVE-2026-29179

October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations

October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access but had editor.cms_as…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:19:52.447Z. Updated 2026-04-21T16:46:47.873Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated21 Apr 2026, 23:46 WIB

Official record

HighPublished 21 Apr 2026, 23:17 WIB

CVE-2026-24189

CVE-2026-24189

NVIDIA CUDA-Q contains a vulnerability in an endpoint, where an unauthenticated attacker could cause an out-of-bounds read by sending a maliciously crafted request. A successful exploit of this vulnerability might lead to denial of service and information disclosure.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:17:54.323Z. Updated 2026-04-21T16:41:23.992Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated21 Apr 2026, 23:41 WIB

Official record

HighPublished 21 Apr 2026, 23:17 WIB

CVE-2026-24177

CVE-2026-24177

NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of this vulnerability might lead to information disclosure.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:17:26.431Z. Updated 2026-04-21T16:42:36.727Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated21 Apr 2026, 23:42 WIB

Official record

LowPublished 21 Apr 2026, 23:17 WIB

CVE-2026-27937

October: Reflected XSS via DataTable Form Widget

October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:17:06.973Z. Updated 2026-04-21T20:37:33.620Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 03:37 WIB

Official record

MedPublished 21 Apr 2026, 23:17 WIB

CVE-2026-24176

CVE-2026-24176

NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. A successful exploit of this vulnerability might lead to data tampering.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:17:00.601Z. Updated 2026-04-21T16:43:30.471Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated21 Apr 2026, 23:43 WIB

Official record

MedPublished 21 Apr 2026, 23:16 WIB

CVE-2026-26274

October: Safe Mode Bypass via Twig Database Write Operations

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:16:06.488Z. Updated 2026-04-21T19:16:38.739Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:16 WIB

Official record

MedPublished 21 Apr 2026, 23:16 WIB

CVE-2026-26067

October: Safe Mode Bypass via CSS Preprocessor Compilers

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import funct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:16:03.293Z. Updated 2026-04-21T17:35:19.882Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:35 WIB

Official record

CritPublished 21 Apr 2026, 23:11 WIB

CVE-2019-25714

Seeyon Office Anywhere (OA) A8 Unauthenticated Arbitrary File Write via htmlofficeservlet

Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:11:54.961Z. Updated 2026-07-28T01:47:01.094Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:47 WIB

Official record

HighPublished 21 Apr 2026, 23:08 WIB

CVE-2026-40568

FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization

FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a stored cross-site scripting (XSS) vulnerability in the mailbox signature feature. The sanitization function `Helper::stripDangerousTags()` (`app/Misc/Helper.php:568`) uses an incomplete blocklist of only four HTML tags (`scri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:08:37.296Z. Updated 2026-04-21T20:37:44.431Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 03:37 WIB

Official record

MedPublished 21 Apr 2026, 23:06 WIB

CVE-2026-40567

FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can inject arbitrary HTML into outgoing emails generated by FreeScout by sending an email with a crafted From display name. The name is stored in the database without sanitization and rendered unescaped i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:06:39.878Z. Updated 2026-04-21T19:17:33.873Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:17 WIB

Official record

MedPublished 21 Apr 2026, 23:05 WIB

CVE-2026-25542

Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchSt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:05:43.217Z. Updated 2026-05-22T16:06:24.202Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 May 2026, 23:06 WIB

Official record

MedPublished 21 Apr 2026, 23:04 WIB

CVE-2026-40566

FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints

FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a Server-Side Request Forgery (SSRF) vulnerability in the IMAP/SMTP connection test functionality of FreeScout's `MailboxesController`. Three AJAX actions `fetch_test` (line 731), `send_test` (line 682), and `imap_folders` (li…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T16:04:35.587Z. Updated 2026-04-21T17:33:11.528Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:33 WIB

Official record