Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1001–1020 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-54872

Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-sign…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:15.075Z. Updated 2026-09-29T17:28:12.657Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 00:28 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-42772

Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1001 to 1020 of 14934.First page Next page

Published 2026-09-29T15:32:14.009Z. Updated 2026-09-30T20:11:09.295Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-35191

QUIC Unvalidated Amplification Credit may be Over Accounted

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:12.944Z. Updated 2026-09-30T20:11:09.437Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-35189

Excessive Memory Allocation in Relative CRLDP Processing

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:11.889Z. Updated 2026-09-30T20:11:09.577Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

HighPublished 29 Sep 2026, 22:30 WIB

CVE-2026-97687

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:30:27.136Z. Updated 2026-09-30T20:11:09.721Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:29 WIB

CVE-2026-93332

CVE-2026-93332

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:29:20.156Z. Updated 2026-09-30T20:11:09.869Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

LowPublished 29 Sep 2026, 22:26 WIB

CVE-2026-102601

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes PCRE to return false,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:26:42.044Z. Updated 2026-09-29T16:02:04.360Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:02 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:25 WIB

CVE-2026-93330

CVE-2026-93330

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:25:16.942Z. Updated 2026-09-29T15:40:51.204Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:40 WIB

Official record

HighPublished 29 Sep 2026, 22:23 WIB

CVE-2026-102600

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:23:15.857Z. Updated 2026-09-29T16:28:28.476Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:28 WIB

Official record

MedPublished 29 Sep 2026, 22:16 WIB

CVE-2026-102598

Werkzeug safe_join() allows Windows special device names

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:16:28.900Z. Updated 2026-09-29T15:44:10.657Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:44 WIB

Official record

CritPublished 29 Sep 2026, 22:13 WIB

CVE-2023-54400

Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection techniques against the Micro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:13:10.616Z. Updated 2026-09-30T15:09:51.628Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:09 WIB

Official record

HighPublished 29 Sep 2026, 22:05 WIB

CVE-2026-100308

GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:05:53.802Z. Updated 2026-09-30T15:28:19.374Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

HighPublished 29 Sep 2026, 21:59 WIB

CVE-2026-68911

Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T14:59:09.588Z. Updated 2026-09-29T16:05:09.695Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:05 WIB

Official record

HighPublished 29 Sep 2026, 21:58 WIB

CVE-2026-63209

Integer Overflow or Wraparound and Out-of-bounds Write in compress

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T14:58:53.366Z. Updated 2026-09-29T16:32:32.677Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:32 WIB

Official record

HighPublished 29 Sep 2026, 21:58 WIB

CVE-2015-20122

Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject UNION-based SQL statement…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T14:58:49.924Z. Updated 2026-09-29T16:07:01.698Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:07 WIB

Official record

HighPublished 29 Sep 2026, 21:58 WIB

CVE-2026-86035

Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T14:58:20.313Z. Updated 2026-10-02T12:09:21.053Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:09 WIB

Official record

CritPublished 29 Sep 2026, 21:57 WIB

CVE-2026-49243

Webmin: Reflected XSS in the Configuration module

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version 2.650.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T14:57:48.911Z. Updated 2026-10-13T14:34:36.657Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated13 Oct 2026, 21:34 WIB

Official record

MedPublished 29 Sep 2026, 21:45 WIB

CVE-2026-102491

mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injection. Remote exploitation …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T14:45:10.272Z. Updated 2026-09-29T16:33:37.627Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:33 WIB

Official record

CritPublished 29 Sep 2026, 21:31 WIB

CVE-2026-22094

Weak root password in EVbee DC 80

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T14:31:33.304Z. Updated 2026-10-19T09:10:58.451Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated19 Oct 2026, 16:10 WIB

Official record

MedPublished 29 Sep 2026, 21:31 WIB

CVE-2026-22101

Sensitive information leak through hidden menu

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T14:31:28.451Z. Updated 2026-10-19T09:10:53.028Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated19 Oct 2026, 16:10 WIB

Official record