Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1101–1120 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 28 Oct 2026, 05:18 WIB

CVE-2026-58496

ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7, the `SFNT/TTF` font loader's `SfntLoader::gen` function in `tvgSfntLoader.cpp` reads `data[0] through data[3]` to identify the font type without first checking that the input buffer contains at least four bytes. Loading an under…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T22:18:34.301Z. Updated 2026-10-27T22:18:34.301Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 05:18 WIB

Official record

MedPublished 28 Oct 2026, 05:15 WIB

CVE-2026-118128

a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1101 to 1120 of 16156.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T22:15:19.102Z. Updated 2026-10-28T16:12:56.611Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:12 WIB

Official record

LowPublished 28 Oct 2026, 04:52 WIB

CVE-2026-57199

Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers` without sufficient bounds checks, allowing an attacker to co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:52:42.436Z. Updated 2026-10-27T21:52:42.436Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 04:52 WIB

Official record

MedPublished 28 Oct 2026, 04:48 WIB

CVE-2026-57203

Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory. An attacker already authorized to open a shell session on th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:48:40.078Z. Updated 2026-10-27T21:48:40.078Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 04:48 WIB

Official record

HighPublished 28 Oct 2026, 04:45 WIB

CVE-2026-57190

Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:45:50.075Z. Updated 2026-10-28T16:13:06.105Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:13 WIB

Official record

UnscoredPublished 28 Oct 2026, 04:38 WIB

CVE-2026-97045

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:38:56.700Z. Updated 2026-10-27T21:38:56.700Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 04:38 WIB

Official record

UnscoredPublished 28 Oct 2026, 04:38 WIB

CVE-2026-78661

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:38:56.517Z. Updated 2026-10-27T21:38:56.517Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 04:38 WIB

Official record

HighPublished 28 Oct 2026, 04:37 WIB

CVE-2026-62765

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:37:20.753Z. Updated 2026-10-29T15:21:50.214Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:21 WIB

Official record

HighPublished 28 Oct 2026, 04:32 WIB

CVE-2026-57191

Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:32:23.714Z. Updated 2026-10-27T21:32:23.714Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 04:32 WIB

Official record

MedPublished 28 Oct 2026, 04:25 WIB

CVE-2026-57192

Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the `Codec2` decoder caused by a `floor/ceil sample-c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:25:40.363Z. Updated 2026-10-27T21:25:40.363Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 04:25 WIB

Official record

HighPublished 28 Oct 2026, 04:21 WIB

CVE-2026-57186

Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:21:55.833Z. Updated 2026-10-28T16:13:12.086Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:13 WIB

Official record

HighPublished 28 Oct 2026, 04:13 WIB

CVE-2026-57200

Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `R…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:13:03.777Z. Updated 2026-10-27T21:13:03.777Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 04:13 WIB

Official record

HighPublished 28 Oct 2026, 04:04 WIB

CVE-2026-57195

Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the `Asterisk Manager Interface (AMI)` may allow an unauthenticated attacker to crash Asterisk when `Digest Authenti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T21:04:25.747Z. Updated 2026-10-27T21:04:25.747Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 04:04 WIB

Official record

HighPublished 28 Oct 2026, 03:37 WIB

CVE-2026-85898

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T20:37:28.112Z. Updated 2026-10-29T15:09:07.810Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:09 WIB

Official record

HighPublished 28 Oct 2026, 03:37 WIB

CVE-2026-83831

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T20:37:26.445Z. Updated 2026-10-29T15:09:06.195Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:09 WIB

Official record

LowPublished 28 Oct 2026, 03:27 WIB

CVE-2026-116775

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4 bytes are available with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T20:27:30.852Z. Updated 2026-10-27T20:27:30.852Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 03:27 WIB

Official record

MedPublished 28 Oct 2026, 03:25 WIB

CVE-2026-116774

russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writable in russh/src/channels/io/tx.rs. The Channel::data, Channel::make_writer, and Ch…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T20:25:26.914Z. Updated 2026-10-28T16:13:18.607Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:13 WIB

Official record

MedPublished 28 Oct 2026, 03:23 WIB

CVE-2026-116773

russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication, while the standards-compliant EXT_INF…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T20:23:25.559Z. Updated 2026-10-27T20:23:47.305Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 03:23 WIB

Official record

LowPublished 28 Oct 2026, 03:14 WIB

CVE-2026-116696

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retaine…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T20:14:32.973Z. Updated 2026-10-27T20:14:32.973Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 03:14 WIB

Official record

MedPublished 28 Oct 2026, 03:10 WIB

CVE-2026-116695

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T20:10:34.010Z. Updated 2026-10-27T20:10:34.010Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 03:10 WIB

Official record