Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1121–1140 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59319

RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure

RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:46.944Z. Updated 2026-08-28T22:47:00.784Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:47 WIB

Official record

MedPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59317

In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 -…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1121 to 1140 of 12259.First page Next page

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:46.006Z. Updated 2026-08-28T22:47:09.357Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:47 WIB

Official record

HighPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59316

Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:44.963Z. Updated 2026-08-28T22:47:16.884Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:47 WIB

Official record

MedPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59315

Spring Cloud Config Monitor Denial of Service

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:42.065Z. Updated 2026-08-28T22:47:23.491Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:47 WIB

Official record

UnscoredPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59314

Spring Framework response splitting in ContentDisposition

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:41.062Z. Updated 2026-09-01T14:59:44.827Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:59 WIB

Official record

MedPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59311

Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:40.084Z. Updated 2026-08-28T22:47:29.614Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:47 WIB

Official record

LowPublished 28 Aug 2026, 01:04 WIB

CVE-2026-59306

Potential for deserialization of untrusted types in Spring Cloud Stream

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T18:04:39.066Z. Updated 2026-08-28T18:34:15.271Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:34 WIB

Official record

UnscoredPublished 28 Aug 2026, 00:58 WIB

CVE-2026-59313

Server Sent Event stream corruption in Spring MVC functional web framework

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:58:03.621Z. Updated 2026-08-28T19:59:45.069Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Aug 2026, 02:59 WIB

Official record

HighPublished 28 Aug 2026, 00:58 WIB

CVE-2026-59307

Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Excerpt language: en.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:58:02.683Z. Updated 2026-08-29T03:55:53.369Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 10:55 WIB

Official record

LowPublished 28 Aug 2026, 00:58 WIB

CVE-2026-59305

Partition interceptor may be improperly added while sending message

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:58:01.756Z. Updated 2026-08-28T18:34:56.205Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:34 WIB

Official record

LowPublished 28 Aug 2026, 00:58 WIB

CVE-2026-59304

Improper caching of the original content type in Spring Cloud Stream Avro

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:58:00.802Z. Updated 2026-08-28T22:47:36.173Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:47 WIB

Official record

LowPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59303

Dynamic destination cache size is not properly bound in Spring Cloud Stream

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:59.869Z. Updated 2026-08-28T22:47:44.786Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:47 WIB

Official record

LowPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59302

Potential for logging sensitive data in Spring Cloud Stream

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:58.899Z. Updated 2026-08-28T22:47:52.531Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:47 WIB

Official record

LowPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59301

Potential for logging sensitive data in Spring Cloud Function Azure

Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:57.960Z. Updated 2026-08-28T22:47:58.312Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:47 WIB

Official record

LowPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59300

Potential for logging sensitive data in Spring Cloud Function AWS

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:57.010Z. Updated 2026-08-28T22:48:05.882Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:48 WIB

Official record

LowPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59299

Composition lookup can potentially poison base function in Spring Cloud Function

Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:56.024Z. Updated 2026-08-28T22:48:12.246Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:48 WIB

Official record

LowPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59298

Potential for improper filtering of HTTP headers in Spring Cloud Function

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:55.073Z. Updated 2026-09-01T14:59:51.550Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:59 WIB

Official record

LowPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59297

Spring Cloud Function can incorrectly determine if URI is secure

Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:53.989Z. Updated 2026-08-28T18:35:31.544Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:35 WIB

Official record

MedPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59294

Arbitrary File Write via Path Traversal in ResourceCacheService

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:52.047Z. Updated 2026-08-28T18:36:07.272Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:36 WIB

Official record

MedPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59293

SMB minimum protocol dialect defaults to SMB1

Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:51.016Z. Updated 2026-08-28T18:36:46.105Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:36 WIB

Official record