Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1101–1120 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

CritPublished 28 Aug 2026, 02:00 WIB

CVE-2026-18886

Unauthenticated Privilege Escalation via System Configuration Image Upload Processor

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ServiceNow deploye…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T19:00:01.715Z. Updated 2026-09-02T22:07:23.647Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated03 Sep 2026, 05:07 WIB

Official record

CritPublished 28 Aug 2026, 01:54 WIB

CVE-2026-18885

Unauthenticated Remote Code Execution in GraphQL Composite Data API

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1101 to 1120 of 12259.First page Next page

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:54:14.827Z. Updated 2026-08-29T03:56:08.287Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 10:56 WIB

Official record

CritPublished 28 Aug 2026, 01:46 WIB

CVE-2026-6876

Sandbox Escape in ServiceNow AI Platform

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than intended. Serv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:46:04.798Z. Updated 2026-09-01T18:58:49.323Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 01:58 WIB

Official record

MedPublished 28 Aug 2026, 01:34 WIB

CVE-2026-81893

Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery

A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:34:03.016Z. Updated 2026-08-28T14:29:06.460Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 21:29 WIB

Official record

MedPublished 28 Aug 2026, 01:33 WIB

CVE-2026-34616

DNG SDK | Out-of-bounds Read (CWE-125)

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:33:58.874Z. Updated 2026-08-28T15:42:40.150Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:42 WIB

Official record

MedPublished 28 Aug 2026, 01:33 WIB

CVE-2026-34620

DNG SDK | Out-of-bounds Write (CWE-787)

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to corrupt memory, causing the application to crash or become unresponsive. Exploitation of this issue requires user interaction in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:33:58.189Z. Updated 2026-08-31T18:18:29.543Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:18 WIB

Official record

MedPublished 28 Aug 2026, 01:32 WIB

CVE-2026-81530

KMS master key exposure via unredacted credential serialization in driver settings string

A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret field…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:32:32.877Z. Updated 2026-08-28T15:44:10.176Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:44 WIB

Official record

HighPublished 28 Aug 2026, 01:32 WIB

CVE-2026-81529

Connection-option injection via unescaped settings in the canonical MongoDB URL builder

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:32:31.650Z. Updated 2026-08-28T16:37:37.138Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 23:37 WIB

Official record

MedPublished 28 Aug 2026, 01:32 WIB

CVE-2026-81528

NoSQL injection via array replacement bypassing update shape validation in driver write path

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a repl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:32:30.215Z. Updated 2026-08-28T15:45:22.840Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:45 WIB

Official record

MedPublished 28 Aug 2026, 01:32 WIB

CVE-2026-81527

NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:32:28.926Z. Updated 2026-08-28T15:46:55.682Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:46 WIB

Official record

HighPublished 28 Aug 2026, 01:32 WIB

CVE-2026-81526

Cross-database write redirection via unvalidated dotted database name in bulk write namespaces

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:32:27.704Z. Updated 2026-08-28T15:48:02.435Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:48 WIB

Official record

HighPublished 28 Aug 2026, 01:32 WIB

CVE-2026-81525

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:32:26.493Z. Updated 2026-08-28T15:49:03.964Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:49 WIB

Official record

MedPublished 28 Aug 2026, 01:32 WIB

CVE-2026-81524

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:32:25.355Z. Updated 2026-08-28T15:50:10.011Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:50 WIB

Official record

LowPublished 28 Aug 2026, 01:32 WIB

CVE-2026-81523

Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:32:24.206Z. Updated 2026-08-28T15:51:12.001Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:51 WIB

Official record

HighPublished 28 Aug 2026, 01:32 WIB

CVE-2026-81522

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:32:23.151Z. Updated 2026-08-29T03:55:54.810Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 10:55 WIB

Official record

HighPublished 28 Aug 2026, 01:31 WIB

CVE-2026-81521

Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:31:45.450Z. Updated 2026-10-06T18:17:46.581Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated07 Oct 2026, 01:17 WIB

Official record

HighPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59324

fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:51.595Z. Updated 2026-08-28T22:46:33.636Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:46 WIB

Official record

MedPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59322

EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untruste…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:50.137Z. Updated 2026-08-28T22:46:40.016Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:46 WIB

Official record

MedPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59321

Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers bindings into another me…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:49.035Z. Updated 2026-08-28T22:46:47.321Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:46 WIB

Official record

MedPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59320

In Spring AMQP the link credit never replenished on listener exception path

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:47.999Z. Updated 2026-08-28T22:46:54.662Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:46 WIB

Official record