Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1141–1160 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

LowPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59292

World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:50.029Z. Updated 2026-08-28T18:37:24.514Z.

CVSS3.2v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:37 WIB

Official record

LowPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59291

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

Excerpt language: en.

Severity low: primary CNA CVSS 2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1141 to 1160 of 12259.First page Next page

Published 2026-08-27T17:57:48.943Z. Updated 2026-08-28T18:38:29.352Z.

CVSS2v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:38 WIB

Official record

UnscoredPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59289

Spring for GraphQL Denial of Service via pagination support

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying dat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:47.944Z. Updated 2026-09-02T16:29:16.153Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Sep 2026, 23:29 WIB

Official record

UnscoredPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59288

Spring for GraphQL Information Exposure in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for Gra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:46.990Z. Updated 2026-09-01T15:36:35.910Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Sep 2026, 22:36 WIB

Official record

UnscoredPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59287

Spring for GraphQL WebSocket Client Denial of Service

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:45.951Z. Updated 2026-09-02T16:33:55.633Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Sep 2026, 23:33 WIB

Official record

UnscoredPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59286

Spring for GraphQL loads Untrusted Resources in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:44.958Z. Updated 2026-09-02T17:35:48.563Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Sep 2026, 00:35 WIB

Official record

UnscoredPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59285

Spring for GraphQL Unsafe Deserialization in pagination support

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:43.851Z. Updated 2026-09-02T18:14:59.496Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Sep 2026, 01:14 WIB

Official record

MedPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59284

Spring Cloud Commons no allow list for writable env actuator endpoint

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier

Excerpt language: en.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:42.527Z. Updated 2026-08-28T18:32:18.345Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:32 WIB

Official record

UnscoredPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59283

Spring Framework Safety Guard Bypass via SpEL Expression Compilation

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Sp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:40.065Z. Updated 2026-08-28T18:40:46.456Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:40 WIB

Official record

UnscoredPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59282

Spring Framework Denial of Service via Unbounded List Growth in Data Binding

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:38.575Z. Updated 2026-08-28T18:30:40.789Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:30 WIB

Official record

UnscoredPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59281

Spring Framework Cross-site Scripting via EscapedErrors

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:37.157Z. Updated 2026-08-28T18:56:23.590Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:56 WIB

Official record

LowPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59277

Spring Security InetAddressMatchers Incomplete Internal Network Classification

Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:36.006Z. Updated 2026-08-28T14:01:04.295Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 21:01 WIB

Official record

MedPublished 28 Aug 2026, 00:57 WIB

CVE-2026-59276

Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:57:34.993Z. Updated 2026-08-28T14:00:41.248Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 21:00 WIB

Official record

MedPublished 28 Aug 2026, 00:53 WIB

CVE-2026-4398

Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:53:14.609Z. Updated 2026-08-28T14:13:54.361Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 21:13 WIB

Official record

HighPublished 28 Aug 2026, 00:52 WIB

CVE-2026-76640

Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:52:11.749Z. Updated 2026-08-28T15:53:16.149Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:53 WIB

Official record

HighPublished 28 Aug 2026, 00:51 WIB

CVE-2026-76639

Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:51:46.346Z. Updated 2026-08-31T18:56:06.235Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:56 WIB

Official record

MedPublished 28 Aug 2026, 00:50 WIB

CVE-2026-65931

LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:50:47.311Z. Updated 2026-08-28T14:13:54.515Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 21:13 WIB

Official record

CritPublished 28 Aug 2026, 00:36 WIB

CVE-2026-48996

Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an attacker-supplied import archiv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:36:07.483Z. Updated 2026-08-29T03:56:03.899Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 10:56 WIB

Official record

HighPublished 28 Aug 2026, 00:22 WIB

CVE-2026-75889

CVE-2026-75889 CVE Record

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:22:22.328Z. Updated 2026-08-28T16:55:05.074Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 23:55 WIB

Official record

MedPublished 28 Aug 2026, 00:21 WIB

CVE-2026-54732

libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base name. A filename containing ../ can escape the temporary directory because path.base…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:21:50.743Z. Updated 2026-08-28T14:54:16.963Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 21:54 WIB

Official record