Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1121–1140 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 28 Oct 2026, 03:09 WIB

CVE-2026-116694

OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T20:09:06.484Z. Updated 2026-10-28T16:13:25.340Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:13 WIB

Official record

HighPublished 28 Oct 2026, 03:07 WIB

CVE-2026-116693

dd-trace: ReDOS in URL query string obfuscation

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1121 to 1140 of 16156.First page Next page

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T20:07:01.195Z. Updated 2026-10-27T20:07:01.195Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 03:07 WIB

Official record

CritPublished 28 Oct 2026, 03:03 WIB

CVE-2026-116692

MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allow…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T20:03:49.661Z. Updated 2026-10-27T20:03:49.661Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 03:03 WIB

Official record

LowPublished 28 Oct 2026, 02:58 WIB

CVE-2026-103995

Lenient parsing of integers for response body and chunk framing

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.

Excerpt language: en.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:58:52.521Z. Updated 2026-10-28T00:33:14.944Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 07:33 WIB

Official record

MedPublished 28 Oct 2026, 02:56 WIB

CVE-2026-116691

MLflow CrewAI autologging records LLM provider API keys in logged trace spans

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:56:22.083Z. Updated 2026-10-27T19:56:22.083Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 02:56 WIB

Official record

CritPublished 28 Oct 2026, 02:43 WIB

CVE-2026-112352

Sunhillo SureLine Authentication Bypass via Session Cookie

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:43:34.052Z. Updated 2026-10-28T16:13:31.837Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:13 WIB

Official record

HighPublished 28 Oct 2026, 02:43 WIB

CVE-2026-112351

Sunhillo SureLine OS Command Injection via networkDiag.cgi

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomple…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:43:19.355Z. Updated 2026-10-27T19:43:42.029Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 02:43 WIB

Official record

HighPublished 28 Oct 2026, 02:43 WIB

CVE-2026-112350

Sunhillo SureLine Path Traversal via radarUpdater.cgi

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory trav…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:43:01.386Z. Updated 2026-10-27T19:43:01.386Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 02:43 WIB

Official record

HighPublished 28 Oct 2026, 02:42 WIB

CVE-2026-116690

MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:42:35.798Z. Updated 2026-10-28T16:13:38.096Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:13 WIB

Official record

MedPublished 28 Oct 2026, 02:38 WIB

CVE-2026-116689

follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:38:46.034Z. Updated 2026-10-27T19:38:46.034Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 02:38 WIB

Official record

HighPublished 28 Oct 2026, 02:36 WIB

CVE-2026-116688

CKEditor: Cross-site scripting (XSS) in the engine package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthori…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:36:28.906Z. Updated 2026-10-27T19:36:28.906Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 02:36 WIB

Official record

LowPublished 28 Oct 2026, 02:33 WIB

CVE-2026-116687

CKEditor: Cross-site scripting (XSS) in the engine package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled Ja…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:33:11.074Z. Updated 2026-10-27T19:33:11.074Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 02:33 WIB

Official record

MedPublished 28 Oct 2026, 02:29 WIB

CVE-2026-116686

Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref val…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:29:16.001Z. Updated 2026-10-28T16:13:45.473Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:13 WIB

Official record

MedPublished 28 Oct 2026, 02:26 WIB

CVE-2026-116685

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client client paths enable follow_redirects and follow redirects t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:26:46.926Z. Updated 2026-10-27T19:26:46.926Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 02:26 WIB

Official record

HighPublished 28 Oct 2026, 02:15 WIB

CVE-2026-112355

MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API

The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request hand…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:15:49.546Z. Updated 2026-10-27T19:15:49.546Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 02:15 WIB

Official record

MedPublished 28 Oct 2026, 02:12 WIB

CVE-2026-116684

Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T19:12:24.255Z. Updated 2026-10-27T19:12:24.255Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 02:12 WIB

Official record

HighPublished 28 Oct 2026, 01:25 WIB

CVE-2026-116683

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T18:25:50.885Z. Updated 2026-10-27T18:25:50.885Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 01:25 WIB

Official record

UnscoredPublished 28 Oct 2026, 01:16 WIB

CVE-2026-118180

Matrix homeserver could redirect the chat session to a local file or network share

When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T18:16:33.495Z. Updated 2026-10-27T18:27:53.280Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 01:27 WIB

Official record

UnscoredPublished 28 Oct 2026, 01:16 WIB

CVE-2026-118179

Request forgery via news: links

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reacha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T18:16:32.658Z. Updated 2026-10-27T18:27:52.176Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 01:27 WIB

Official record

UnscoredPublished 28 Oct 2026, 01:16 WIB

CVE-2026-118178

RSS feed could redirect its subscription to a local file or network share

A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T18:16:31.904Z. Updated 2026-10-27T18:27:51.092Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 01:27 WIB

Official record