Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 101–120 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 01 Sep 2026, 00:54 WIB

CVE-2026-79749

MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, MCPHub's SSRF guard in src/utils/ssrf.ts uses a custom isBlockedIpv6 function that only checks for loopback, link-local, unique-local,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:54:45.423Z. Updated 2026-08-31T18:48:57.445Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:48 WIB

Official record

HighPublished 01 Sep 2026, 00:54 WIB

CVE-2026-79750

MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.30, MCPHub scopes non-admin users to servers they own (list views and config edits enforce ownership), but the tool-execution API does not…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 101 to 120 of 12259.First page Next page

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:54:14.295Z. Updated 2026-09-02T14:03:22.817Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 21:03 WIB

Official record

MedPublished 01 Sep 2026, 00:45 WIB

CVE-2026-82816

dibo-software diboot AI Session Endpoint ai-session authorization

A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:45:09.357Z. Updated 2026-08-31T18:41:30.170Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:41 WIB

Official record

MedPublished 01 Sep 2026, 00:30 WIB

CVE-2026-82815

MegaEase EaseProbe Middleware server.go realIP access control

A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulation of the argument X-Forwarded-For/X-Real-IP/True-Client-IP causes improper access controls. The attack can be initiated remotely. The exploit has been published…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:30:08.524Z. Updated 2026-08-31T17:51:14.790Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:51 WIB

Official record

UnscoredPublished 01 Sep 2026, 00:29 WIB

CVE-2026-19953

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:29:42.929Z. Updated 2026-09-01T15:16:50.672Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Sep 2026, 22:16 WIB

Official record

MedPublished 01 Sep 2026, 00:15 WIB

CVE-2026-82813

BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch the attack remotely. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:15:08.307Z. Updated 2026-08-31T21:57:56.543Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 04:57 WIB

Official record

MedPublished 01 Sep 2026, 00:00 WIB

CVE-2026-82811

Toggl OÜ Toggl Track Extension postMessage origin validation

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The ven…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:00:10.617Z. Updated 2026-08-31T18:47:25.115Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:47 WIB

Official record

MedPublished 31 Aug 2026, 23:47 WIB

CVE-2026-14366

SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt

The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c frees a network packet it does not own. In the Zephyr TX path the net_pkt is owned by the L2/networking stack; the driver only borrows it to copy the frame bytes into a local net_buf. Before the fix, after tra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T16:47:48.478Z. Updated 2026-09-01T14:47:39.271Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:47 WIB

Official record

MedPublished 31 Aug 2026, 23:45 WIB

CVE-2026-82810

extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T16:45:09.367Z. Updated 2026-09-02T14:01:57.079Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 21:01 WIB

Official record

MedPublished 31 Aug 2026, 23:30 WIB

CVE-2026-82809

vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is possible to be carried out…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T16:30:09.210Z. Updated 2026-08-31T17:54:42.375Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:54 WIB

Official record

MedPublished 31 Aug 2026, 23:15 WIB

CVE-2026-82808

Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T16:15:09.377Z. Updated 2026-08-31T19:02:39.743Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 02:02 WIB

Official record

HighPublished 31 Aug 2026, 23:15 WIB

CVE-2026-17615

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T16:15:01.739Z. Updated 2026-10-28T19:11:02.456Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:11 WIB

Official record

CritPublished 31 Aug 2026, 23:00 WIB

CVE-2026-82807

ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management

A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. This issue affects some unknown processing in the library URDSCSI.sys of the component Kernel Driver. This manipulation causes improper privilege management. The attack needs to be launched locally. The exploit has been publicly disclosed and may be ut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T16:00:08.780Z. Updated 2026-09-01T18:10:50.983Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 01:10 WIB

Official record

MedPublished 31 Aug 2026, 22:53 WIB

CVE-2026-83492

WordPress Kubio AI Website Builder - Denial Of Service

Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:53:57.808Z. Updated 2026-08-31T16:14:52.669Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:14 WIB

Official record

LowPublished 31 Aug 2026, 22:48 WIB

CVE-2026-21827

HCL Connections is vulnerable to an information disclosure vulnerability

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:48:17.026Z. Updated 2026-09-01T14:47:00.025Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:47 WIB

Official record

MedPublished 31 Aug 2026, 22:45 WIB

CVE-2026-82805

Typora Mermaid Rendering cross site scripting

A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:45:07.352Z. Updated 2026-08-31T16:09:12.808Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:09 WIB

Official record

HighPublished 31 Aug 2026, 22:33 WIB

CVE-2026-77966

Ebyte NA111-M Missing Authorization

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the device.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:33:30.167Z. Updated 2026-10-05T19:22:28.810Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated06 Oct 2026, 02:22 WIB

Official record

CritPublished 31 Aug 2026, 22:30 WIB

CVE-2026-76133

Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm

The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate unauthorized acce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:30:38.351Z. Updated 2026-10-05T19:26:19.802Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Oct 2026, 02:26 WIB

Official record

MedPublished 31 Aug 2026, 22:30 WIB

CVE-2026-82803

armink struct2json JSON Deserialization s2jdef.h S2J_STRUCT_GET_string_ELEMENT null pointer dereference

A vulnerability has been found in armink struct2json 1.0. This affects the function S2J_STRUCT_GET_string_ELEMENT in the library struct2json/inc/s2jdef.h of the component JSON Deserialization. The manipulation of the argument valuestring leads to null pointer dereference. The attack may be initiated remotely. The explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:30:10.550Z. Updated 2026-09-02T14:00:00.445Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 21:00 WIB

Official record

CritPublished 31 Aug 2026, 22:28 WIB

CVE-2026-73819

Ebyte NA111-M Weak Authentication

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:28:32.047Z. Updated 2026-10-05T19:26:52.632Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Oct 2026, 02:26 WIB

Official record