Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 1961–1980 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 21 Apr 2026, 08:33 WIB

CVE-2026-40250

OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, `internal_dwa_compressor.h:1040` performs `chan->width * chan->bytes_per_element` in `int32` ari…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T01:33:00.212Z. Updated 2026-04-23T03:55:57.543Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated23 Apr 2026, 10:55 WIB

Official record

HighPublished 21 Apr 2026, 08:30 WIB

CVE-2026-40244

OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.4.0 through 3.4.9, 3.3.0 through 3.3.9, and 3.2.0 through 3.2.7, `internal_dwa_compressor.h:1722` performs `curc->width * curc->height` in `int32` arithmetic wit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1961 to 1980 of 5813.First page Next page

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T01:30:55.061Z. Updated 2026-07-15T01:01:12.086Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:01 WIB

Official record

MedPublished 21 Apr 2026, 08:27 WIB

CVE-2026-39886

OpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl()

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Versions 3.4.0 through 3.4.9 have a signed integer overflow vulnerability in OpenEXR's HTJ2K (High-Throughput JPEG 2000) decompression path. The `ht_undo_impl()` function in `…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T01:27:01.371Z. Updated 2026-04-21T13:49:21.573Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated21 Apr 2026, 20:49 WIB

Official record

HighPublished 21 Apr 2026, 08:19 WIB

CVE-2026-39866

Lawnchair vulnerable to Command Injection via unquoted workflow dispatch input in release_update.yml

Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command injection in release_update.yml workflow dispatch input allows arbitrary code execution. Commit fcba413f55dd47f8a3921445252849126c6266b2 patches the issue.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T01:19:47.510Z. Updated 2026-04-25T03:55:32.652Z.

CVSS7.4v4.0KEVNot listedEPSSPresentUpdated25 Apr 2026, 10:55 WIB

Official record

HighPublished 21 Apr 2026, 07:56 WIB

CVE-2026-39861

Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:56:39.062Z. Updated 2026-04-21T13:44:49.618Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated21 Apr 2026, 20:44 WIB

Official record

HighPublished 21 Apr 2026, 07:50 WIB

CVE-2026-39386

Neko has Self-service Privilege Escalation for Authenticated Users

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, room settings, broadcast control, session termination, etc.). Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:50:34.656Z. Updated 2026-04-22T03:56:19.795Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 10:56 WIB

Official record

LowPublished 21 Apr 2026, 07:47 WIB

CVE-2026-40264

OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.

Excerpt language: en.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:47:38.156Z. Updated 2026-04-21T19:30:51.975Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:30 WIB

Official record

LowPublished 21 Apr 2026, 07:44 WIB

CVE-2026-39396

OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written. An attacker who c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:44:53.943Z. Updated 2026-04-21T19:49:18.821Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:49 WIB

Official record

LowPublished 21 Apr 2026, 07:43 WIB

CVE-2026-39388

OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented mTLS certificate matches the original. Token renewals for other…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:43:22.920Z. Updated 2026-04-21T19:36:07.865Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:36 WIB

Official record

MedPublished 21 Apr 2026, 07:19 WIB

CVE-2026-39946

OpenBao allows SQL Injection in PostgreSQL database secrets engine

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rare…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:19:39.578Z. Updated 2026-04-21T13:34:21.088Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated21 Apr 2026, 20:34 WIB

Official record

MedPublished 21 Apr 2026, 07:17 WIB

CVE-2026-39378

nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sens…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:17:00.684Z. Updated 2026-04-21T13:43:29.081Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Apr 2026, 20:43 WIB

Official record

MedPublished 21 Apr 2026, 07:14 WIB

CVE-2026-39377

nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPrepro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:14:59.937Z. Updated 2026-04-21T19:49:24.475Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:49 WIB

Official record

HighPublished 21 Apr 2026, 07:07 WIB

CVE-2026-39320

Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:07:10.371Z. Updated 2026-04-21T19:36:54.787Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:36 WIB

Official record

UnscoredPublished 21 Apr 2026, 07:00 WIB

CVE-2026-29644

CVE-2026-29644

XiangShan (open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) has improper gating of its distributed CSR write-enable path, allowing illegal CSR write attempts to alter custom PMA (Physical Memory Attribute) CSR state. Though the RISC-V privileged specification r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:00:00.000Z. Updated 2026-04-21T17:59:06.506Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:59 WIB

Official record

UnscoredPublished 21 Apr 2026, 07:00 WIB

CVE-2026-30452

CVE-2026-30452

Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in textpattern/include/txp_a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:00:00.000Z. Updated 2026-04-22T15:35:46.859Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 22:35 WIB

Official record

UnscoredPublished 21 Apr 2026, 07:00 WIB

CVE-2026-31013

CVE-2026-31013

Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint. User-supplied input is reflected in the HTTP response without proper input validation or output encoding, allowing execution of arbitrary JavaScript in t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:00:00.000Z. Updated 2026-04-21T18:19:12.306Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 01:19 WIB

Official record

UnscoredPublished 21 Apr 2026, 07:00 WIB

CVE-2026-31014

CVE-2026-31014

Dovestones Softwares AD Self Update <4.0.0.5 is vulnerable to Cross Site Request Forgery (CSRF). The affected endpoint processes state-changing requests without requiring a CSRF token or equivalent protection. The endpoint accepts application/x-www-form-urlencoded requests, and an originally POST-based request can be c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:00:00.000Z. Updated 2026-04-21T18:21:08.828Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 01:21 WIB

Official record

UnscoredPublished 21 Apr 2026, 07:00 WIB

CVE-2026-31018

CVE-2026-31018

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:00:00.000Z. Updated 2026-07-05T01:32:48.765Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:32 WIB

Official record

UnscoredPublished 21 Apr 2026, 07:00 WIB

CVE-2026-31019

CVE-2026-31019

In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the abil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:00:00.000Z. Updated 2026-07-05T01:32:53.264Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:32 WIB

Official record

UnscoredPublished 21 Apr 2026, 07:00 WIB

CVE-2026-37748

CVE-2026-37748

Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is called without any MIME type, extension, or content validation, allowing an authenticated admin to upload a PHP webshell and achieve Remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-21T00:00:00.000Z. Updated 2026-04-21T18:25:24.762Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 01:25 WIB

Official record