Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1021–1040 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 28 Oct 2026, 09:03 WIB

CVE-2026-117608

Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow

Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causing heap out-of-bounds…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:17.365Z. Updated 2026-10-28T02:03:17.365Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2026-117607

Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1021 to 1040 of 16156.First page Next page

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:16.664Z. Updated 2026-10-28T02:03:16.664Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

MedPublished 28 Oct 2026, 09:03 WIB

CVE-2026-117606

NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:15.947Z. Updated 2026-10-28T02:03:15.947Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

MedPublished 28 Oct 2026, 09:03 WIB

CVE-2026-117605

nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:15.191Z. Updated 2026-10-28T16:12:20.568Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:12 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2015-20129

CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:14.501Z. Updated 2026-10-28T02:03:14.501Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2014-125138

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:13.805Z. Updated 2026-10-28T02:03:13.805Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2014-125137

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:13.087Z. Updated 2026-10-28T02:03:13.087Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2014-125136

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMM…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:12.414Z. Updated 2026-10-28T16:12:26.616Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:12 WIB

Official record

MedPublished 28 Oct 2026, 09:03 WIB

CVE-2013-20009

Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter

Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:11.721Z. Updated 2026-10-28T02:03:11.721Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2013-20008

Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password

Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take pe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:11.024Z. Updated 2026-10-28T02:03:11.024Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2013-20007

Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:10.353Z. Updated 2026-10-28T02:03:10.353Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

MedPublished 28 Oct 2026, 09:00 WIB

CVE-2026-118272

a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:00:21.447Z. Updated 2026-10-28T16:12:32.352Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:12 WIB

Official record

CritPublished 28 Oct 2026, 08:30 WIB

CVE-2026-106013

Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T01:30:48.320Z. Updated 2026-10-29T01:52:00.079Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:52 WIB

Official record

MedPublished 28 Oct 2026, 08:30 WIB

CVE-2026-118271

a2ui-project a2ui data-context Resolver data-context.ts resource consumption

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from remote. The exploit h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T01:30:47.285Z. Updated 2026-10-28T01:30:47.285Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 08:30 WIB

Official record

CritPublished 28 Oct 2026, 07:07 WIB

CVE-2026-110879

jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T00:07:41.577Z. Updated 2026-10-28T00:07:41.577Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 07:07 WIB

Official record

HighPublished 28 Oct 2026, 07:02 WIB

CVE-2026-110747

jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload

ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input conta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T00:02:32.462Z. Updated 2026-10-28T00:02:32.462Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 07:02 WIB

Official record

HighPublished 28 Oct 2026, 07:01 WIB

CVE-2026-104895

jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T00:01:44.496Z. Updated 2026-10-28T00:01:44.496Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 07:01 WIB

Official record

UnscoredPublished 28 Oct 2026, 07:00 WIB

CVE-2026-106971

CVE-2026-106971

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T00:00:00.000Z. Updated 2026-10-28T14:16:29.731Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 21:16 WIB

Official record

UnscoredPublished 28 Oct 2026, 07:00 WIB

CVE-2026-106972

CVE-2026-106972

An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T00:00:00.000Z. Updated 2026-10-28T14:17:14.242Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 21:17 WIB

Official record

HighPublished 28 Oct 2026, 06:52 WIB

CVE-2026-104016

jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflow…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T23:52:20.141Z. Updated 2026-10-27T23:52:20.141Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 06:52 WIB

Official record