Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1881–1900 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

CritPublished 26 Aug 2026, 05:12 WIB

CVE-2026-80138

ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T22:12:23.914Z. Updated 2026-08-26T12:23:55.095Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 19:23 WIB

Official record

MedPublished 26 Aug 2026, 05:09 WIB

CVE-2026-70665

Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this al…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1881 to 1900 of 12259.First page Next page

Published 2026-08-25T22:09:53.197Z. Updated 2026-08-27T14:34:50.455Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:34 WIB

Official record

HighPublished 26 Aug 2026, 05:04 WIB

CVE-2026-63403

Faktory: Unrecovered panic in command handlers allows full-server denial of service

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice or index the received line at a fixed of…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T22:04:48.255Z. Updated 2026-08-26T14:31:10.402Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:31 WIB

Official record

UnscoredPublished 26 Aug 2026, 05:01 WIB

CVE-2026-73180

Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T22:01:58.000Z. Updated 2026-08-26T18:35:13.414Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:35 WIB

Official record

HighPublished 26 Aug 2026, 05:01 WIB

CVE-2026-63404

Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that lets a local unprivileged user hijack the Redis configuration and escalate to root. It writes its startup configuration to a fixed, predictable, world-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T22:01:19.220Z. Updated 2026-08-28T22:40:31.790Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:40 WIB

Official record

UnscoredPublished 26 Aug 2026, 05:00 WIB

CVE-2026-68763

Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at the time t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T22:00:37.047Z. Updated 2026-08-26T18:36:43.341Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:36 WIB

Official record

MedPublished 26 Aug 2026, 05:00 WIB

CVE-2026-79845

code-projects Simple Inventory System edit.php sql injection

A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T22:00:11.376Z. Updated 2026-08-26T14:32:32.575Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:32 WIB

Official record

UnscoredPublished 26 Aug 2026, 04:59 WIB

CVE-2026-68569

Apache Tomcat: Principal lookup can fail open in some cases

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:59:17.438Z. Updated 2026-09-21T11:06:13.066Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Sep 2026, 18:06 WIB

Official record

MedPublished 26 Aug 2026, 04:58 WIB

CVE-2026-80185

Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root

BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:58:16.883Z. Updated 2026-10-16T11:54:41.199Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 18:54 WIB

Official record

HighPublished 26 Aug 2026, 04:58 WIB

CVE-2026-80186

Bluez: stack overflow in name2utf8 causes dos and potential code execution

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:58:16.875Z. Updated 2026-10-16T11:51:22.918Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 18:51 WIB

Official record

UnscoredPublished 26 Aug 2026, 04:57 WIB

CVE-2026-68525

Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:57:18.557Z. Updated 2026-08-26T18:40:55.312Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:40 WIB

Official record

UnscoredPublished 26 Aug 2026, 04:55 WIB

CVE-2026-66422

Apache Tomcat: Servlet role references can bypass declarative role constraints

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:55:16.928Z. Updated 2026-08-26T18:52:26.487Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:52 WIB

Official record

UnscoredPublished 26 Aug 2026, 04:53 WIB

CVE-2026-65927

Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:53:05.852Z. Updated 2026-08-26T15:22:01.843Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:22 WIB

Official record

HighPublished 26 Aug 2026, 04:52 WIB

CVE-2026-62865

TypeBot: Arbitrary server file read via Send Email block attachment path

Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the supplied value as a filesys…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:52:16.717Z. Updated 2026-08-26T12:31:36.135Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 19:31 WIB

Official record

UnscoredPublished 26 Aug 2026, 04:51 WIB

CVE-2026-65905

Apache Tomcat: Limited replay attack possible with DIGEST authentication

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:51:33.307Z. Updated 2026-08-26T15:21:11.604Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:21 WIB

Official record

UnscoredPublished 26 Aug 2026, 04:49 WIB

CVE-2026-65637

Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:49:13.127Z. Updated 2026-08-26T15:20:30.366Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:20 WIB

Official record

MedPublished 26 Aug 2026, 04:46 WIB

CVE-2026-62861

TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a client-supplied workspaceId but…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:46:24.861Z. Updated 2026-08-27T14:35:10.158Z.

CVSS6.4v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:35 WIB

Official record

UnscoredPublished 26 Aug 2026, 04:44 WIB

CVE-2026-65183

Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120. User…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:44:49.363Z. Updated 2026-08-26T15:19:19.234Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:19 WIB

Official record

UnscoredPublished 26 Aug 2026, 04:43 WIB

CVE-2026-65182

Apache Tomcat: Bypass longest prefix security constraint

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:43:37.040Z. Updated 2026-08-26T15:18:16.813Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:18 WIB

Official record

CritPublished 26 Aug 2026, 04:43 WIB

CVE-2026-62862

TypeBot: Account takeover via brute-forceable 6-digit magic-link code

Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secure token with a 6-digit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T21:43:21.320Z. Updated 2026-08-26T15:04:13.958Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:04 WIB

Official record