Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1161–1180 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 28 Aug 2026, 00:19 WIB

CVE-2026-54718

Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflow…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:19:51.691Z. Updated 2026-08-31T18:17:17.110Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:17 WIB

Official record

MedPublished 28 Aug 2026, 00:11 WIB

CVE-2026-55758

CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the RFC 8215 64:ff9b:1::/48 …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1161 to 1180 of 12259.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:11:00.307Z. Updated 2026-08-28T18:04:09.124Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:04 WIB

Official record

MedPublished 28 Aug 2026, 00:06 WIB

CVE-2026-54687

n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:06:40.278Z. Updated 2026-08-28T18:05:12.764Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:05 WIB

Official record

CritPublished 28 Aug 2026, 00:05 WIB

CVE-2026-19092

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:05:37.621Z. Updated 2026-08-28T13:03:21.752Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 20:03 WIB

Official record

LowPublished 28 Aug 2026, 00:03 WIB

CVE-2026-54713

CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T17:03:31.580Z. Updated 2026-08-28T15:55:52.105Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:55 WIB

Official record

MedPublished 27 Aug 2026, 23:55 WIB

CVE-2026-25250

CVE-2026-25250

EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:55:27.336Z. Updated 2026-08-28T14:11:20.298Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 21:11 WIB

Official record

HighPublished 27 Aug 2026, 23:52 WIB

CVE-2026-54721

Silverstripe UserForms: Remote code execution via userforms email subject

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:52:46.023Z. Updated 2026-08-28T15:58:28.067Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:58 WIB

Official record

HighPublished 27 Aug 2026, 23:51 WIB

CVE-2026-47727

Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side template that leads to re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:51:35.090Z. Updated 2026-09-01T14:49:11.152Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:49 WIB

Official record

MedPublished 27 Aug 2026, 23:44 WIB

CVE-2026-66353

Doggo vulnerable to cross-site scripting via unescaped date field values

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize_value/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker meaning "already escaped, emit verbatim", without escaping them, s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:44:59.553Z. Updated 2026-08-28T14:13:54.861Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 21:13 WIB

Official record

UnscoredPublished 27 Aug 2026, 23:41 WIB

CVE-2026-59280

Spring Framework Path Traversal via Backslash in SpringTemplateLoader

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:41:09.664Z. Updated 2026-08-27T17:42:15.735Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:42 WIB

Official record

MedPublished 27 Aug 2026, 23:41 WIB

CVE-2026-59272

Log4j2 AmqpAppender disables TLS hostname verification by default

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:41:08.650Z. Updated 2026-08-28T03:55:35.123Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 10:55 WIB

Official record

MedPublished 27 Aug 2026, 23:40 WIB

CVE-2026-79720

CVE-2026-79720

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:40:09.913Z. Updated 2026-08-27T18:49:38.838Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 01:49 WIB

Official record

MedPublished 27 Aug 2026, 23:39 WIB

CVE-2026-79719

CVE-2026-79719

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:39:10.117Z. Updated 2026-08-27T18:52:39.505Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 01:52 WIB

Official record

MedPublished 27 Aug 2026, 23:37 WIB

CVE-2026-79718

CVE-2026-79718

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:37:25.817Z. Updated 2026-08-27T18:53:05.315Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 01:53 WIB

Official record

MedPublished 27 Aug 2026, 23:35 WIB

CVE-2026-19854

CVE-2026-19854 CVE Record

When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:35:17.652Z. Updated 2026-08-27T17:44:26.203Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:44 WIB

Official record

HighPublished 27 Aug 2026, 23:33 WIB

CVE-2026-75871

Server-Side Request Forgery (SSRF) in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:33:55.451Z. Updated 2026-08-27T18:58:34.704Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 01:58 WIB

Official record

HighPublished 27 Aug 2026, 23:33 WIB

CVE-2026-19889

Server-Side Request Forgery (SSRF) in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-controlled endpoint via cr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:33:50.570Z. Updated 2026-08-27T19:00:15.667Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:00 WIB

Official record

HighPublished 27 Aug 2026, 23:25 WIB

CVE-2026-5680

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denia…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:25:29.103Z. Updated 2026-10-20T14:15:38.754Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 21:15 WIB

Official record

HighPublished 27 Aug 2026, 23:12 WIB

CVE-2026-78002

Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:12:59.102Z. Updated 2026-10-26T16:10:06.136Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:10 WIB

Official record

MedPublished 27 Aug 2026, 23:01 WIB

CVE-2026-75573

MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T16:01:55.302Z. Updated 2026-08-27T18:46:12.847Z.

CVSS4.1v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 01:46 WIB

Official record