Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 1881–1900 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 24 Mar 2026, 10:11 WIB

CVE-2026-4736

Math Issue in No-Chicken/Echo-Mate

Improper Handling of Values vulnerability in No-Chicken Echo-Mate (SDK/rv1106-sdk/sysdrv/source/kernel/include/net/netfilter modules). This vulnerability is associated with program files nf_tables.H‎, nft_byteorder.C‎, nft_meta.C‎. This issue affects Echo-Mate: before V250329.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T03:11:16.951Z. Updated 2026-03-24T14:36:13.673Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:36 WIB

Official record

HighPublished 24 Mar 2026, 10:08 WIB

CVE-2026-4735

A stack overflow and DoS vulnerability in DTStack/chunjun

Deserialization of Untrusted Data vulnerability in DTStack chunjun (‎chunjun-core/src/main/java/com/dtstack/chunjun/util modules). This vulnerability is associated with program files GsonUtil.Java. This issue affects chunjun: before 1.16.1.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T03:08:18.156Z. Updated 2026-03-24T14:36:43.076Z.

Showing 1881 to 1900 of 6236.First page Next page

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:36 WIB

Official record

CritPublished 24 Mar 2026, 10:05 WIB

CVE-2026-4734

Heap Buffer Overflow in yoyofr/modizer

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in yoyofr modizer (libs/libopenmpt/openmpt-trunk/include/premake/contrib/curl/lib modules). This vulnerability is associated with program files imap.C‎. This issue affects modizer: before v4.3.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T03:05:39.360Z. Updated 2026-03-24T14:37:08.508Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:37 WIB

Official record

MedPublished 24 Mar 2026, 09:52 WIB

CVE-2026-4733

Information disclosure in ixray-1.6-stcop

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T02:52:45.529Z. Updated 2026-03-24T18:27:50.320Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated25 Mar 2026, 01:27 WIB

Official record

HighPublished 24 Mar 2026, 09:50 WIB

CVE-2026-4732

Out-of-bounds Read Overflow in tildearrow/furnace

Out-of-bounds Read vulnerability in tildearrow furnace (‎extern/libsndfile-modified/src modules). This vulnerability is associated with program files flac.C‎. This issue affects furnace: before 0.7.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T02:50:36.111Z. Updated 2026-03-24T18:28:11.937Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated25 Mar 2026, 01:28 WIB

Official record

MedPublished 24 Mar 2026, 09:46 WIB

CVE-2026-4626

projectworlds Lawyer Management System lawyer_booking.php cross site scripting

A vulnerability has been found in projectworlds Lawyer Management System 1.0. This impacts an unknown function of the file /lawyer_booking.php. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T02:46:13.972Z. Updated 2026-03-26T12:29:09.031Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 19:29 WIB

Official record

MedPublished 24 Mar 2026, 09:46 WIB

CVE-2026-4625

SourceCodester Online Admission System programmes.php sql injection

A flaw has been found in SourceCodester Online Admission System 1.0. This affects an unknown function of the file /programmes.php. Executing a manipulation of the argument program can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T02:46:11.088Z. Updated 2026-03-24T13:24:16.006Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 20:24 WIB

Official record

HighPublished 24 Mar 2026, 09:44 WIB

CVE-2026-4731

An Integer Overflow Vulnerability in artraweditor/ART

Integer Overflow or Wraparound vulnerability in artraweditor ART (‎rtengine‎ modules). This vulnerability is associated with program files dcraw.C. This issue affects ART: before 1.25.12.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T02:44:42.382Z. Updated 2026-03-24T18:28:42.590Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated25 Mar 2026, 01:28 WIB

Official record

MedPublished 24 Mar 2026, 09:14 WIB

CVE-2026-4624

SourceCodester Online Library Management System Parameter home.php sql injection

A vulnerability was detected in SourceCodester Online Library Management System 1.0. The impacted element is an unknown function of the file /home.php of the component Parameter Handler. Performing a manipulation of the argument searchField results in sql injection. The attack can be initiated remotely. The exploit is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T02:14:35.899Z. Updated 2026-03-24T18:25:52.685Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Mar 2026, 01:25 WIB

Official record

MedPublished 24 Mar 2026, 08:39 WIB

CVE-2026-4623

DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery

A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This affects an unknown function of the file /api/System.php of the component API Module. The manipulation of the argument url leads to server-side request forgery. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T01:39:39.469Z. Updated 2026-03-24T15:12:29.310Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:12 WIB

Official record

MedPublished 24 Mar 2026, 08:36 WIB

CVE-2026-33308

mod_gnutls missing key purpose check in client certificate verification

Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Prior to version 0.13.0, code for client certificate verification did not check the key purpose as set in the Extended Key Usage extension. An attacker with access to the private key for a valid certificate issued by a CA trusted for TLS client authentication…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T01:36:50.545Z. Updated 2026-03-24T13:34:05.647Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 20:34 WIB

Official record

HighPublished 24 Mar 2026, 08:34 WIB

CVE-2026-33307

mod_gnutils has stack-based buffer overflow caused by a long client certificate chain

Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. In versions prior to 0.12.3 and 0.13.0, code for client certificate verification imported the certificate chain sent by the client into a fixed size `gnutls_x509_crt_t x509[]` array without checking the number of certificates is less than or equal to the arra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T01:34:36.146Z. Updated 2026-03-24T15:12:34.370Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:12 WIB

Official record

MedPublished 24 Mar 2026, 08:25 WIB

CVE-2026-3079

LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter

The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filters[orderby_order]' parameter in the 'learndash_propanel_template' AJAX action in all versions up to, and including, 5.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient prepa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T01:25:21.251Z. Updated 2026-04-08T16:43:20.936Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:43 WIB

Official record

MedPublished 24 Mar 2026, 07:52 WIB

CVE-2026-4617

SourceCodester Patients Waiting Area Queue Management System Patient Check-In api_patient_checkin.php ValidateToken improper authorization

A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is the function ValidateToken of the file /php/api_patient_checkin.php of the component Patient Check-In Module. Executing a manipulation can lead to improper authorization. It is possible to launch …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T00:52:31.044Z. Updated 2026-03-24T13:34:46.349Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 20:34 WIB

Official record

UnscoredPublished 24 Mar 2026, 07:24 WIB

CVE-2026-4680

CVE-2026-4680

Use after free in FedCM in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T00:24:43.349Z. Updated 2026-03-25T03:55:36.575Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2026, 10:55 WIB

Official record

UnscoredPublished 24 Mar 2026, 07:24 WIB

CVE-2026-4679

CVE-2026-4679

Integer overflow in Fonts in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T00:24:42.991Z. Updated 2026-03-25T03:55:40.157Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2026, 10:55 WIB

Official record

UnscoredPublished 24 Mar 2026, 07:24 WIB

CVE-2026-4678

CVE-2026-4678

Use after free in WebGPU in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T00:24:42.657Z. Updated 2026-03-25T03:55:37.921Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2026, 10:55 WIB

Official record

UnscoredPublished 24 Mar 2026, 07:24 WIB

CVE-2026-4677

CVE-2026-4677

Inappropriate implementation in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T00:24:42.233Z. Updated 2026-03-25T03:55:44.958Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2026, 10:55 WIB

Official record

UnscoredPublished 24 Mar 2026, 07:24 WIB

CVE-2026-4676

CVE-2026-4676

Use after free in Dawn in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T00:24:41.828Z. Updated 2026-03-25T03:55:39.011Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2026, 10:55 WIB

Official record

UnscoredPublished 24 Mar 2026, 07:24 WIB

CVE-2026-4675

CVE-2026-4675

Heap buffer overflow in WebGL in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T00:24:41.442Z. Updated 2026-03-25T03:55:41.369Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2026, 10:55 WIB

Official record