Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 1121–1140 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 26 Mar 2026, 00:11 WIB

CVE-2026-33663

n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with the `global:member` role could exploit chained authorization flaws in n8n's credential pipeline to steal plaintext secrets from generic HTTP credentials (`httpBasicAuth`, `httpHeaderAuth`, `htt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T17:11:09.633Z. Updated 2026-03-25T18:06:45.157Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 01:06 WIB

Official record

CritPublished 26 Mar 2026, 00:09 WIB

CVE-2026-33660

n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could use the Merge node's "Combine by SQL" mode to read local files on the n8n host and achieve remote code execution. The AlaSQL sandbox did not suffi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1121 to 1140 of 6236.First page Next page

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T17:09:09.528Z. Updated 2026-03-28T01:27:05.337Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 08:27 WIB

Official record

HighPublished 26 Mar 2026, 00:07 WIB

CVE-2026-27496

n8n has In-Process Memory Disclosure in its Task Runner

n8n is an open source workflow automation platform. Prior to versions 1.123.22, 2.9.3, and 2.10.1, an authenticated user with permission to create or modify workflows could use the JavaScript Task Runner to allocate uninitialized memory buffers. Uninitialized buffers may contain residual data from the same Node.js proc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T17:07:06.221Z. Updated 2026-03-25T20:09:07.795Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 03:09 WIB

Official record

MedPublished 26 Mar 2026, 00:03 WIB

CVE-2026-2414

CVE-2026-2414

Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.5.2 before 10.7.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T17:03:03.308Z. Updated 2026-03-27T14:56:17.171Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 21:56 WIB

Official record

MedPublished 26 Mar 2026, 00:02 WIB

CVE-2026-25645

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write acces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T17:02:48.402Z. Updated 2026-03-25T22:48:33.406Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 05:48 WIB

Official record

MedPublished 25 Mar 2026, 23:59 WIB

CVE-2026-29092

Kiteworks Email Protection Gateway has an Insufficient Session Expiration

Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kite…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:59:55.033Z. Updated 2026-03-25T17:29:41.481Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 00:29 WIB

Official record

MedPublished 25 Mar 2026, 23:58 WIB

CVE-2026-23636

Kiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous Type

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form could potentially exploit an Unrestricted Upload of File with Dangerous Type due to a missing validation. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:58:36.194Z. Updated 2026-03-27T14:56:49.566Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 21:56 WIB

Official record

MedPublished 25 Mar 2026, 23:57 WIB

CVE-2026-23635

Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentials

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:57:19.199Z. Updated 2026-03-25T18:06:51.357Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 01:06 WIB

Official record

MedPublished 25 Mar 2026, 23:56 WIB

CVE-2026-1712

CVE-2026-1712

Incorrect privilege assignment vulnerability in HYPR Server allows Privilege Escalation.This issue affects HYPR Server: from 10.5.1 before 10.7.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:56:05.927Z. Updated 2026-03-27T03:55:32.320Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 10:55 WIB

Official record

MedPublished 25 Mar 2026, 23:54 WIB

CVE-2026-34085

CVE-2026-34085

fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:54:37.187Z. Updated 2026-04-02T17:50:01.562Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 00:50 WIB

Official record

MedPublished 25 Mar 2026, 23:35 WIB

CVE-2025-13078

Improper Validation of Specified Quantity in Input in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when processing certain webhook configuration inputs.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:35:03.858Z. Updated 2026-03-25T17:02:57.718Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 00:02 WIB

Official record

MedPublished 25 Mar 2026, 23:34 WIB

CVE-2025-13436

Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when handling certain CI-related inputs.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:34:53.851Z. Updated 2026-03-25T17:03:54.631Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 00:03 WIB

Official record

MedPublished 25 Mar 2026, 23:34 WIB

CVE-2025-14595

Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to impro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:34:43.856Z. Updated 2026-03-27T14:58:40.717Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 21:58 WIB

Official record

MedPublished 25 Mar 2026, 23:34 WIB

CVE-2026-1724

Missing Authentication for Critical Function in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:34:28.860Z. Updated 2026-03-27T14:59:15.608Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 21:59 WIB

Official record

MedPublished 25 Mar 2026, 23:34 WIB

CVE-2026-2745

Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized access to user accounts due to inconsistent input validation in t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:34:18.860Z. Updated 2026-03-26T03:55:31.559Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 10:55 WIB

Official record

MedPublished 25 Mar 2026, 23:34 WIB

CVE-2026-2726

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to perform unauthorized actions on merge requests in other projects due to improper access control during cross-repository operations…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:34:13.838Z. Updated 2026-03-25T17:14:34.612Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 00:14 WIB

Official record

MedPublished 25 Mar 2026, 23:34 WIB

CVE-2026-2973

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanitization of entity-encoded content in Mermaid diagrams.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:34:03.852Z. Updated 2026-03-26T17:24:32.440Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 00:24 WIB

Official record

HighPublished 25 Mar 2026, 23:33 WIB

CVE-2026-2995

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitization of HTML content.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:33:58.853Z. Updated 2026-03-26T13:20:13.378Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:20 WIB

Official record

HighPublished 25 Mar 2026, 23:33 WIB

CVE-2026-3857

Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:33:53.854Z. Updated 2026-03-26T13:20:03.781Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:20 WIB

Official record

HighPublished 25 Mar 2026, 23:33 WIB

CVE-2026-3988

Inefficient Algorithmic Complexity in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T16:33:43.952Z. Updated 2026-03-25T17:21:53.191Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 00:21 WIB

Official record