Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 1061–1080 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

UnscoredPublished 27 May 2026, 21:13 WIB

CVE-2026-48921

CVE-2026-48921

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T14:13:49.193Z. Updated 2026-05-27T18:35:27.630Z.

CVSS—KEVNot listedEPSSPresentUpdated28 May 2026, 01:35 WIB

Official record

UnscoredPublished 27 May 2026, 21:13 WIB

CVE-2026-48920

CVE-2026-48920

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T14:13:48.568Z. Updated 2026-05-27T15:43:07.808Z.

Showing 1061 to 1080 of 6933.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 22:43 WIB

Official record

UnscoredPublished 27 May 2026, 21:13 WIB

CVE-2026-48919

CVE-2026-48919

Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T14:13:47.832Z. Updated 2026-05-27T15:47:35.773Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 22:47 WIB

Official record

UnscoredPublished 27 May 2026, 21:13 WIB

CVE-2026-48918

CVE-2026-48918

Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T14:13:47.113Z. Updated 2026-05-27T15:48:34.628Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 22:48 WIB

Official record

UnscoredPublished 27 May 2026, 21:13 WIB

CVE-2026-48917

CVE-2026-48917

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T14:13:46.363Z. Updated 2026-05-27T17:04:29.371Z.

CVSS—KEVNot listedEPSSPresentUpdated28 May 2026, 00:04 WIB

Official record

UnscoredPublished 27 May 2026, 21:13 WIB

CVE-2026-48916

CVE-2026-48916

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T14:13:45.516Z. Updated 2026-05-27T15:51:05.829Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 22:51 WIB

Official record

UnscoredPublished 27 May 2026, 20:56 WIB

CVE-2026-7876

Authentication bypass vulnerability found in Aspera High-Speed Transfer Server for Cloud Pak for Integration

IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take advantage of this vulnerability to access files in the server's local storage that they should not have access to, when specific restriction settings are not in place.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:56:16.166Z. Updated 2026-06-11T14:05:33.251Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jun 2026, 21:05 WIB

Official record

HighPublished 27 May 2026, 20:55 WIB

CVE-2026-7365

IBM Operations Analytics - Log Analysis is affected by Information disclosure due to default passwords not being forced to be changed on post-installation

IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:55:22.608Z. Updated 2026-05-27T14:52:38.627Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 21:52 WIB

Official record

MedPublished 27 May 2026, 20:55 WIB

CVE-2026-9617

PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a table and placing malicious code inside a column identifier. If a superuser calls the k-anonymity function, the malicious code is executed with superuser privileges. The risk is higher with PostgreSQL 14 or with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:55:10.863Z. Updated 2026-05-28T03:55:32.305Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 10:55 WIB

Official record

HighPublished 27 May 2026, 20:50 WIB

CVE-2024-56462

IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 002 could allow a privileged user to upload a malicious backup archive that could be restored and used to gain access to the underlying operating system.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:50:26.588Z. Updated 2026-05-27T14:48:10.590Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 21:48 WIB

Official record

MedPublished 27 May 2026, 20:48 WIB

CVE-2024-40684

IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log Analysis does not require that users should have strong passwords by default, which makes it easier for attackers to com…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:48:59.081Z. Updated 2026-05-27T15:33:16.940Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 22:33 WIB

Official record

MedPublished 27 May 2026, 20:47 WIB

CVE-2024-28765

Security vulnerability was found in IBM Security Directory Integrator

IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:47:21.877Z. Updated 2026-05-28T15:39:51.262Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 22:39 WIB

Official record

MedPublished 27 May 2026, 20:21 WIB

CVE-2026-9035

Multiple vulnerabilities in Aspera applications.

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:21:43.995Z. Updated 2026-05-27T14:47:20.101Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 21:47 WIB

Official record

MedPublished 27 May 2026, 20:21 WIB

CVE-2026-23679

libusb < 1.0.30 NULL Pointer Dereference in parse_interface()

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining bu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:21:37.035Z. Updated 2026-07-14T15:53:32.218Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record

MedPublished 27 May 2026, 20:20 WIB

CVE-2026-8405

IBM Guardium Data Protection is affected by Exposure of Sensitive Information vulnerability

IBM Guardium Data Protection 12.2.1, and 12.2.2 's add-on feature of Guardium Data Protection named "Long Term Retention" (LTR) can expose sensitive credentials in debug mode.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:20:52.982Z. Updated 2026-05-27T15:32:44.905Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 22:32 WIB

Official record

MedPublished 27 May 2026, 20:20 WIB

CVE-2026-47104

libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array()

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:20:44.432Z. Updated 2026-07-14T21:33:01.719Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 04:33 WIB

Official record

HighPublished 27 May 2026, 20:20 WIB

CVE-2026-8180

Multiple vulnerabilities in Aspera applications.

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential denial of service in the asperahttpd component. An unauthenticated user can cause the asperahttpd servic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:20:07.809Z. Updated 2026-05-28T19:21:26.833Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 May 2026, 02:21 WIB

Official record

HighPublished 27 May 2026, 20:20 WIB

CVE-2026-48972

WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeedProd LLC SeedProd Pro allows PHP Local File Inclusion. This issue affects SeedProd Pro: from n/a before 6.19.5.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:20:06.474Z. Updated 2026-05-27T14:46:23.991Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 21:46 WIB

Official record

HighPublished 27 May 2026, 20:17 WIB

CVE-2026-8179

Multiple vulnerabilities in Aspera applications.

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a buffer overflow in the asperahttpd component. This vulnerability could allow an authenticated user to execute arbi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:17:50.877Z. Updated 2026-05-28T03:55:31.039Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 10:55 WIB

Official record

CritPublished 27 May 2026, 20:17 WIB

CVE-2026-8175

Multiple vulnerabilities in Aspera applications.

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a buffer overflow in the asperahttpd component. This vulnerability could be exploited to cause a denial of service a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T13:17:06.154Z. Updated 2026-05-28T03:55:29.883Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 10:55 WIB

Official record