Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates
6,933 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.
CVE-2026-48852
PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.
Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T20:19:20.809Z. Updated 2026-05-26T12:39:14.852Z.
Apache Shiro: Session fixation: new session is not created after login by default
Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, when a session already exists, it is not i…
Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T20:19:03.428Z. Updated 2026-05-26T12:39:39.186Z.
CVE-2026-48851
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T20:16:31.485Z. Updated 2026-05-26T12:40:49.268Z.
GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow
A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgread Utility. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been made pub…
Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T20:15:11.726Z. Updated 2026-05-26T12:54:56.758Z.
CVE-2026-48850
PuTTY 0.72 before 0.84 has a double free in RSA KEX.
Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T20:13:58.605Z. Updated 2026-05-26T12:59:46.509Z.
Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. It is possible to la…
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T20:00:18.474Z. Updated 2026-05-28T15:44:33.709Z.
changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserialization
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not …
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:45:09.811Z. Updated 2026-05-26T15:08:15.118Z.
CVE-2026-48849
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.
Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:30:38.414Z. Updated 2026-05-26T13:01:11.210Z.
SourceCodester Student Grades Management System cross-site request forgery
A security flaw has been discovered in SourceCodester Student Grades Management System 1.0. This affects an unknown part. The manipulation results in cross-site request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:30:09.710Z. Updated 2026-05-26T12:50:35.979Z.
CVE-2026-48848
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.
Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:27:54.841Z. Updated 2026-05-26T13:00:52.631Z.
WordPress GamiPress plugin <= 7.6.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ruben Garcia GamiPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GamiPress: from n/a through 7.6.3.
Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:26:51.970Z. Updated 2026-05-26T15:19:51.670Z.
CVE-2026-48847
Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.
Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:23:40.853Z. Updated 2026-05-26T13:02:10.123Z.
CVE-2026-48846
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:21:09.656Z. Updated 2026-05-26T13:05:56.818Z.
CVE-2026-48845
In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:18:09.549Z. Updated 2026-05-27T03:55:26.292Z.
SourceCodester Student Grades Management System students.php cross site scripting
A vulnerability was identified in SourceCodester Student Grades Management System 1.0. Affected by this issue is some unknown functionality of the file students.php. The manipulation of the argument Remarks leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available a…
Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:15:09.731Z. Updated 2026-05-26T12:38:45.429Z.
CVE-2026-48844
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:14:48.753Z. Updated 2026-05-26T12:48:17.535Z.
CVE-2026-48843
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.
Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:11:04.351Z. Updated 2026-05-26T12:50:42.557Z.
CVE-2026-48842
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:06:37.434Z. Updated 2026-09-25T03:55:21.992Z.
SourceCodester Student Grades Management System classroom.php removeStudentFromClassroom improper authorization
A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected by this vulnerability is the function getClassroomStudents/removeStudentFromClassroom of the file classroom.php. Executing a manipulation of the argument classroom_id can lead to improper authorization. The attack may be lau…
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T19:00:11.404Z. Updated 2026-05-27T18:34:21.728Z.
SourceCodester Student Grades Management System grades.php improper authorization
A vulnerability was found in SourceCodester Student Grades Management System 1.0. Affected is an unknown function of the file grades.php. Performing a manipulation of the argument student_id results in improper authorization. The attack may be initiated remotely. The exploit has been made public and could be used.
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-25T18:45:11.976Z. Updated 2026-05-26T13:02:07.124Z.