Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 1101–1120 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 24 Apr 2026, 07:04 WIB

CVE-2026-35064

SenseLive X3050 Missing authentication for critical function

A vulnerability in SenseLive X3050’s management ecosystem allows unauthenticated discovery of deployed units through the vendor’s management protocol, enabling identification of device presence, identifiers, and management interfaces without requiring credentials. Because discovery functions are exposed by the underlyi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:04:30.693Z. Updated 2026-04-24T13:09:10.289Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Apr 2026, 20:09 WIB

Official record

CritPublished 24 Apr 2026, 07:02 WIB

CVE-2026-40620

SenseLive X3050 Missing authentication for critical function

A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of authentication or authorization on the SenseLive config application. The service accepts management connections from any reachable host, enabling unrestricted modification of critica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1101 to 1120 of 5813.First page Next page

Published 2026-04-24T00:02:57.571Z. Updated 2026-04-24T13:09:37.232Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Apr 2026, 20:09 WIB

Official record

HighPublished 24 Apr 2026, 07:00 WIB

CVE-2026-27841

SenseLive X3050 Cross-Site request forgery

A vulnerability in SenseLive X3050's web management interface allows state-changing operations to be triggered without proper Cross-Site Request Forgery (CSRF) protections. Because the application does not enforce server-side validation of request origin or implement CSRF tokens, a malicious external webpage could caus…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:00:57.349Z. Updated 2026-04-24T18:18:30.759Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated25 Apr 2026, 01:18 WIB

Official record

MedPublished 24 Apr 2026, 07:00 WIB

CVE-2026-29051

melange has Path Traversal via .PKGINFO in --persist-lint-results

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) constructs output file paths by joining `--out-dir` with the `arch` and `pkgname` va…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:00:36.253Z. Updated 2026-04-24T13:10:10.825Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated24 Apr 2026, 20:10 WIB

Official record

UnscoredPublished 24 Apr 2026, 07:00 WIB

CVE-2025-59308

CVE-2025-59308

In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution for which they are not an administrator, if they also have the 'Site staff' role.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:00:00.000Z. Updated 2026-04-24T16:12:42.266Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 23:12 WIB

Official record

UnscoredPublished 24 Apr 2026, 07:00 WIB

CVE-2025-61872

CVE-2025-61872

Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search site' feature when using the Elasticsearch7 search plugin. The Elasticsearch function does not properly sanitize input in the query parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:00:00.000Z. Updated 2026-04-24T15:03:27.399Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 22:03 WIB

Official record

UnscoredPublished 24 Apr 2026, 07:00 WIB

CVE-2025-67259

CVE-2025-67259

A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint results in dis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:00:00.000Z. Updated 2026-04-24T17:58:28.632Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Apr 2026, 00:58 WIB

Official record

MedPublished 24 Apr 2026, 07:00 WIB

CVE-2026-30368

CVE-2026-30368

A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:00:00.000Z. Updated 2026-09-08T18:38:12.270Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated09 Sep 2026, 01:38 WIB

Official record

UnscoredPublished 24 Apr 2026, 07:00 WIB

CVE-2026-31050

CVE-2026-31050

Cross Site Scripting vulnerability in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:00:00.000Z. Updated 2026-04-24T15:22:54.550Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 22:22 WIB

Official record

UnscoredPublished 24 Apr 2026, 07:00 WIB

CVE-2026-31051

CVE-2026-31051

An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Client Balance component

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:00:00.000Z. Updated 2026-04-24T15:57:01.333Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 22:57 WIB

Official record

UnscoredPublished 24 Apr 2026, 07:00 WIB

CVE-2026-31052

CVE-2026-31052

An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Checkout Authentication Flow component

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:00:00.000Z. Updated 2026-04-24T16:04:54.622Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 23:04 WIB

Official record

MedPublished 24 Apr 2026, 07:00 WIB

CVE-2026-42095

CVE-2026-42095

bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T00:00:00.000Z. Updated 2026-04-24T14:41:51.939Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated24 Apr 2026, 21:41 WIB

Official record

HighPublished 24 Apr 2026, 06:58 WIB

CVE-2026-40623

SenseLive X3050 Missing Authorization

A vulnerability in SenseLive X3050's web management interface allows critical system and network configuration parameters to be modified without sufficient validation and safety controls. Due to inadequate enforcement of constraints on sensitive functions, parameters such as IP addressing, watchdog timers, reconnect in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T23:58:47.343Z. Updated 2026-04-24T18:18:37.202Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated25 Apr 2026, 01:18 WIB

Official record

MedPublished 24 Apr 2026, 06:58 WIB

CVE-2026-29050

melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a melange configuration file — for example through pull-request-driven CI or build-as-a-service scenarios — could set `pipeline[].uses` to a value containing `../…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T23:58:39.668Z. Updated 2026-04-25T01:38:30.604Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated25 Apr 2026, 08:38 WIB

Official record

MedPublished 24 Apr 2026, 06:56 WIB

CVE-2026-40431

SenseLive X3050 Cleartext transmission of sensitive information

A vulnerability exists in SenseLive X3050’s web management interface due to its reliance on unencrypted HTTP for all administrative communication. Because management traffic, including authentication attempts and configuration data, is transmitted in cleartext, an attacker with access to the same network segment could …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T23:56:49.967Z. Updated 2026-04-24T18:18:43.495Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Apr 2026, 01:18 WIB

Official record

CritPublished 24 Apr 2026, 06:54 WIB

CVE-2026-27843

SenseLive X3050 Missing authentication for critical function

A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be modified without sufficient authentication or server-side validation. By applying unsupported or disruptive values to recovery mechanisms and network settings, an attacker can induce a persistent loc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T23:54:55.051Z. Updated 2026-04-24T13:10:40.862Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated24 Apr 2026, 20:10 WIB

Official record

CritPublished 24 Apr 2026, 06:52 WIB

CVE-2026-39462

SenseLive X3050 Insufficiently Protected Credentials

A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the SenseLive Config 2.0 tool, the interface may indicate that the password update was…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T23:52:16.129Z. Updated 2026-04-24T18:18:50.532Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Apr 2026, 01:18 WIB

Official record

CritPublished 24 Apr 2026, 06:50 WIB

CVE-2026-35503

SenseLive X3050 Use of Hard-coded Credentials

A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded values within browser-executed scripts rather than server-side verification. An attacker with access to the login page could retrieve these exposed parameters and g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T23:50:03.513Z. Updated 2026-04-24T13:51:40.131Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Apr 2026, 20:51 WIB

Official record

MedPublished 24 Apr 2026, 06:48 WIB

CVE-2026-25720

SenseLive X3050 Insufficient session expiration

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requiring re-authentication. An attacker with access to a previously authenticated session could continue interacting with adm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T23:48:16.663Z. Updated 2026-04-24T13:11:12.953Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Apr 2026, 20:11 WIB

Official record

CritPublished 24 Apr 2026, 06:45 WIB

CVE-2026-40630

SenseLive X3050 Authentication bypass using an alternate path or channel

A vulnerability in SenseLive X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improper access control enforcement. An attacker with network access to the device may be able to bypass the intended authentication mechanism and directly interact with sensitive config…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T23:45:46.695Z. Updated 2026-04-24T13:11:46.041Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Apr 2026, 20:11 WIB

Official record