Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1981–2000 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 26 Sep 2026, 03:47 WIB

CVE-2026-100377

Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:47:36.756Z. Updated 2026-09-26T22:51:18.721Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

MedPublished 26 Sep 2026, 03:40 WIB

CVE-2026-91766

Cross-origin credential leak in HTTP stream wrapper redirects

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1981 to 2000 of 14934.First page Next page

Published 2026-09-25T20:40:25.040Z. Updated 2026-09-28T13:31:31.921Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:31 WIB

Official record

HighPublished 26 Sep 2026, 03:37 WIB

CVE-2026-57443

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:37:52.116Z. Updated 2026-09-29T17:45:46.289Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 00:45 WIB

Official record

HighPublished 26 Sep 2026, 03:33 WIB

CVE-2026-91765

SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP valu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:33:03.634Z. Updated 2026-09-28T13:31:32.047Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:31 WIB

Official record

HighPublished 26 Sep 2026, 03:26 WIB

CVE-2026-100369

CliInvoke: Argument Injection in Extensibility Runner Factory

CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs and wrapping executable processes. `CliInvoke` versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1, as well as `AlastairLundy.CliInvoke` v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:26:51.352Z. Updated 2026-09-28T13:42:58.777Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:42 WIB

Official record

MedPublished 26 Sep 2026, 03:26 WIB

CVE-2025-14181

Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, pro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:26:45.445Z. Updated 2026-09-25T20:44:13.720Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Sep 2026, 03:44 WIB

Official record

LowPublished 26 Sep 2026, 03:25 WIB

CVE-2026-100417

RustDesk before 1.5.0 One-Way File Transfer Bypass

RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:25:18.041Z. Updated 2026-09-30T00:09:30.175Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:09 WIB

Official record

MedPublished 26 Sep 2026, 03:18 WIB

CVE-2026-17545

PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the applic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:18:11.288Z. Updated 2026-09-25T20:43:34.157Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 03:43 WIB

Official record

HighPublished 26 Sep 2026, 03:13 WIB

CVE-2026-100391

MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:13:12.968Z. Updated 2026-10-05T14:55:05.292Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 21:55 WIB

Official record

CritPublished 26 Sep 2026, 03:13 WIB

CVE-2026-100390

Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:13:09.522Z. Updated 2026-09-25T20:42:50.268Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 03:42 WIB

Official record

CritPublished 26 Sep 2026, 03:13 WIB

CVE-2026-100389

GestSup before 3.2.62 Remote Code Execution via IMAP Attachment

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket director…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:13:07.623Z. Updated 2026-09-30T11:15:12.444Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 18:15 WIB

Official record

MedPublished 26 Sep 2026, 03:13 WIB

CVE-2026-100388

RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:13:06.546Z. Updated 2026-09-30T00:08:08.572Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:08 WIB

Official record

HighPublished 26 Sep 2026, 03:13 WIB

CVE-2026-100387

pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization

pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into stored patches for exfiltr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:13:05.306Z. Updated 2026-09-30T17:29:31.830Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:29 WIB

Official record

MedPublished 26 Sep 2026, 03:10 WIB

CVE-2026-96879

"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:10:22.476Z. Updated 2026-09-29T21:22:40.501Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 04:22 WIB

Official record

MedPublished 26 Sep 2026, 03:08 WIB

CVE-2026-6103

Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:08:49.333Z. Updated 2026-09-25T20:41:27.115Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated26 Sep 2026, 03:41 WIB

Official record

MedPublished 26 Sep 2026, 03:02 WIB

CVE-2026-93682

Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T20:02:11.467Z. Updated 2026-09-25T20:38:14.346Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated26 Sep 2026, 03:38 WIB

Official record

HighPublished 26 Sep 2026, 02:53 WIB

CVE-2026-100368

CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers

CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. `CliInvoke.Specializations` versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, 3.0.0-alpha.1 through …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T19:53:56.299Z. Updated 2026-09-30T00:06:47.101Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:06 WIB

Official record

MedPublished 26 Sep 2026, 02:41 WIB

CVE-2026-96878

Cargo Exhibit field alias allows stored XSS

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T19:41:56.483Z. Updated 2026-09-29T21:21:41.691Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 04:21 WIB

Official record

MedPublished 26 Sep 2026, 02:39 WIB

CVE-2026-96877

Reflected XSS through Cargo Drilldown full-text search

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T19:39:30.872Z. Updated 2026-09-29T21:21:04.824Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 04:21 WIB

Official record

HighPublished 26 Sep 2026, 02:39 WIB

CVE-2026-100208

Microsoft Office Outlook Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T19:39:27.315Z. Updated 2026-10-28T20:08:46.193Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:08 WIB

Official record