Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1941–1960 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 26 Sep 2026, 09:18 WIB

CVE-2026-100532

openclaw WhatsApp before 2026.8.1 Authentication Bypass

@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login and receive a new QR co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:18:33.146Z. Updated 2026-10-08T15:21:44.766Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 09:18 WIB

CVE-2026-100531

openclaw Slack before 2026.8.1 Authorization Bypass

The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An authenticated caller restricted to a single conversation who…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1941 to 1960 of 14934.First page Next page

Published 2026-09-26T02:18:32.465Z. Updated 2026-10-08T15:21:44.177Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 26 Sep 2026, 09:18 WIB

CVE-2026-100530

OpenClaw before 2026.8.1 Exec Approval Directory Binding

OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materially different effects.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:18:31.770Z. Updated 2026-09-28T17:42:13.849Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:42 WIB

Official record

HighPublished 26 Sep 2026, 09:18 WIB

CVE-2026-100529

OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different no…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:18:31.110Z. Updated 2026-09-29T17:16:55.777Z.

CVSS7.4v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 00:16 WIB

Official record

MedPublished 26 Sep 2026, 09:18 WIB

CVE-2026-100528

OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint

OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:18:30.427Z. Updated 2026-09-30T00:17:10.136Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:17 WIB

Official record

MedPublished 26 Sep 2026, 09:18 WIB

CVE-2026-100527

OpenClaw before 2026.8.2 Denial of Service via Browser Relay

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions from completing Browser …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:18:29.745Z. Updated 2026-10-05T14:55:04.758Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 21:55 WIB

Official record

MedPublished 26 Sep 2026, 09:18 WIB

CVE-2026-100526

Vulnerability in discord

OpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same sender's configured medi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:18:29.070Z. Updated 2026-10-08T15:21:43.407Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

MedPublished 26 Sep 2026, 09:18 WIB

CVE-2026-100525

OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass

The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective role has no read scop…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:18:28.402Z. Updated 2026-10-08T15:21:42.617Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

MedPublished 26 Sep 2026, 07:59 WIB

CVE-2026-100524

Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause extensions by tricking t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T00:59:24.986Z. Updated 2026-09-30T00:16:30.714Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:16 WIB

Official record

MedPublished 26 Sep 2026, 07:59 WIB

CVE-2026-100523

Cotonti through 1.0.0 Open Redirect via message.php redirect parameter

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T00:59:24.331Z. Updated 2026-10-05T14:55:04.892Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 21:55 WIB

Official record

MedPublished 26 Sep 2026, 07:59 WIB

CVE-2026-100522

Cotonti through 1.0.0 Reflected XSS via message.php lng parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T00:59:23.634Z. Updated 2026-09-28T17:41:33.542Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:41 WIB

Official record

MedPublished 26 Sep 2026, 07:59 WIB

CVE-2026-100521

Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, inc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T00:59:22.982Z. Updated 2026-09-29T17:22:25.279Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 00:22 WIB

Official record

HighPublished 26 Sep 2026, 07:59 WIB

CVE-2026-100520

Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T00:59:22.329Z. Updated 2026-09-30T00:15:32.907Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:15 WIB

Official record

MedPublished 26 Sep 2026, 07:36 WIB

CVE-2026-100505

Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager

Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries containing strings or constant byte stores that end in multi-b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T00:36:33.247Z. Updated 2026-10-05T14:55:05.029Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 21:55 WIB

Official record

HighPublished 26 Sep 2026, 07:36 WIB

CVE-2026-100504

Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T00:36:32.604Z. Updated 2026-10-22T09:48:43.541Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated22 Oct 2026, 16:48 WIB

Official record

MedPublished 26 Sep 2026, 07:36 WIB

CVE-2026-100503

Ghidra through 12.1.4 Heap Use-After-Free in Decompiler

Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T00:36:31.894Z. Updated 2026-10-22T09:48:42.871Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated22 Oct 2026, 16:48 WIB

Official record

MedPublished 26 Sep 2026, 05:18 WIB

CVE-2026-86066

Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_validated, is_validate_request_approved, approved_by, and related pending-request state through an HTTP GET before calling attendance.save(), so Django does not r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T22:18:13.406Z. Updated 2026-09-30T00:14:31.548Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:14 WIB

Official record

HighPublished 26 Sep 2026, 05:17 WIB

CVE-2026-96795

Horilla: Authenticated RCE in Horilla List-View Export

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted strin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T22:17:04.855Z. Updated 2026-09-28T13:48:15.085Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:48 WIB

Official record

HighPublished 26 Sep 2026, 05:10 WIB

CVE-2026-57449

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the proxy automatically attaches the server's GitHub token to G…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T22:10:39.706Z. Updated 2026-09-28T13:07:46.380Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:07 WIB

Official record

MedPublished 26 Sep 2026, 05:04 WIB

CVE-2026-100502

Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T22:04:02.084Z. Updated 2026-09-30T00:13:26.591Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:13 WIB

Official record