Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1961–1980 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 26 Sep 2026, 05:04 WIB

CVE-2026-100501

Flame through 2.4.0 Brute-Force Attack via Login Endpoint

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or dela…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T22:04:01.425Z. Updated 2026-10-05T14:55:05.164Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 21:55 WIB

Official record

HighPublished 26 Sep 2026, 05:04 WIB

CVE-2026-100419

gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1961 to 1980 of 14934.First page Next page

Published 2026-09-25T22:04:00.750Z. Updated 2026-09-28T13:06:21.364Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:06 WIB

Official record

MedPublished 26 Sep 2026, 05:04 WIB

CVE-2026-100418

Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to cons…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T22:04:00.085Z. Updated 2026-09-29T17:39:22.712Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 00:39 WIB

Official record

HighPublished 26 Sep 2026, 04:59 WIB

CVE-2026-71483

Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T21:59:50.220Z. Updated 2026-09-29T17:42:24.531Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 00:42 WIB

Official record

MedPublished 26 Sep 2026, 04:58 WIB

CVE-2026-63432

Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django templ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T21:58:21.585Z. Updated 2026-09-28T14:32:45.939Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 21:32 WIB

Official record

MedPublished 26 Sep 2026, 04:56 WIB

CVE-2026-63431

Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)

Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can subst…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T21:56:00.074Z. Updated 2026-09-30T00:11:12.578Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:11 WIB

Official record

HighPublished 26 Sep 2026, 04:20 WIB

CVE-2026-88003

InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because Admin_Controller trusts the user_type snapshot stored in an existing session instead of revalidating ip_users.user_typ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T21:20:13.236Z. Updated 2026-09-28T13:04:37.691Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:04 WIB

Official record

MedPublished 26 Sep 2026, 04:11 WIB

CVE-2026-92842

OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the orig…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T21:11:57.236Z. Updated 2026-09-28T13:31:31.256Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:31 WIB

Official record

MedPublished 26 Sep 2026, 04:07 WIB

CVE-2026-91768

IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T21:07:30.950Z. Updated 2026-09-28T13:31:31.382Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:31 WIB

Official record

MedPublished 26 Sep 2026, 04:05 WIB

CVE-2026-100383

Stored i18n XSS in WikiLambda's VisualEditor integration

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T21:05:51.966Z. Updated 2026-09-26T22:51:17.609Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

CritPublished 26 Sep 2026, 04:04 WIB

CVE-2026-100382

Unauthenticated remote code execution through wikitext in ExternalData

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T21:04:02.848Z. Updated 2026-09-26T22:51:17.735Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

MedPublished 26 Sep 2026, 04:00 WIB

CVE-2026-100381

UploadWizard Flickr collection and set titles allow DOM XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T21:00:42.736Z. Updated 2026-09-26T22:51:17.860Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

MedPublished 26 Sep 2026, 03:59 WIB

CVE-2026-91769

TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:59:39.727Z. Updated 2026-10-04T16:10:05.639Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated04 Oct 2026, 23:10 WIB

Official record

MedPublished 26 Sep 2026, 03:58 WIB

CVE-2026-100380

Reflected XSS in Wikibase Special:SetLabel language validation

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:58:24.004Z. Updated 2026-09-26T22:51:17.986Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

MedPublished 26 Sep 2026, 03:54 WIB

CVE-2026-100379

Cross-request disclosure of CentralAuth cookies in Wikipedia Android App

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:54:08.355Z. Updated 2026-09-26T22:51:18.194Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

MedPublished 26 Sep 2026, 03:53 WIB

CVE-2026-91767

Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:53:42.587Z. Updated 2026-09-28T13:31:31.640Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:31 WIB

Official record

MedPublished 26 Sep 2026, 03:50 WIB

CVE-2026-100378

Missing permission check in the Translate sandbox doRemind action

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:50:28.366Z. Updated 2026-09-26T22:51:18.316Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

HighPublished 26 Sep 2026, 03:49 WIB

CVE-2026-10758

Esri Lerc has a security vulnerability

Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker controlled imagery to an appl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:49:43.438Z. Updated 2026-09-26T22:51:18.457Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

MedPublished 26 Sep 2026, 03:48 WIB

CVE-2026-100376

TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:48:53.688Z. Updated 2026-09-26T22:51:18.594Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

LowPublished 26 Sep 2026, 03:48 WIB

CVE-2025-1218

Various packet overreads in mysqlnd_writeprotocol.c

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.

Excerpt language: en.

Severity low: primary CNA CVSS 3.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:48:21.777Z. Updated 2026-09-28T13:31:31.774Z.

CVSS3.4v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:31 WIB

Official record