Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates
16,156 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.
Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:35:05.870Z. Updated 2026-10-27T17:35:05.870Z.
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
Severity low: primary CNA CVSS 3.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:35:05.683Z. Updated 2026-10-27T17:35:05.683Z.
Tanium addressed a denial of service vulnerability in Enforce.
Tanium addressed a denial of service vulnerability in Enforce.
Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:34:47.970Z. Updated 2026-10-27T17:34:47.970Z.
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
Severity low: primary CNA CVSS 2.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:33:55.473Z. Updated 2026-10-27T17:33:55.473Z.
Tanium addressed a heap-based buffer overflow vulnerability in Index.
Tanium addressed a heap-based buffer overflow vulnerability in Index.
Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:33:55.273Z. Updated 2026-10-27T17:33:55.273Z.
Neko: Authorization bypass in legacy WebRTC input handling
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room membe…
Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:33:35.883Z. Updated 2026-10-28T16:13:59.494Z.
Tanium addressed a denial of service vulnerability in Tanium Server.
Tanium addressed a denial of service vulnerability in Tanium Server.
Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:33:33.737Z. Updated 2026-10-27T17:33:33.737Z.
Tanium addressed a compression bomb vulnerability in Enforce.
Tanium addressed a compression bomb vulnerability in Enforce.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:33:33.558Z. Updated 2026-10-27T17:33:33.558Z.
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:33:33.369Z. Updated 2026-10-27T17:33:33.369Z.
Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:32:07.314Z. Updated 2026-10-27T17:32:07.314Z.
Tanium addressed a SQL injection vulnerability in Provision.
Tanium addressed a SQL injection vulnerability in Provision.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:31:29.433Z. Updated 2026-10-27T17:31:29.433Z.
Tanium addressed a SQL injection vulnerability in Patch.
Tanium addressed a SQL injection vulnerability in Patch.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:30:53.396Z. Updated 2026-10-27T17:30:53.396Z.
oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be initiated remotely. Th…
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:30:18.655Z. Updated 2026-10-27T17:30:18.655Z.
Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.
Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.
Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:27:10.729Z. Updated 2026-10-27T17:27:10.729Z.
Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get_page_with_referer() without applying should_block_host() to the second-stage host. Th…
Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:27:03.509Z. Updated 2026-10-27T17:27:03.509Z.
CVE-2026-118131
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:23:46.474Z. Updated 2026-10-27T17:23:46.474Z.
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's certificat…
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:23:01.792Z. Updated 2026-10-27T17:23:01.792Z.
CVE-2026-16491 CVE Record
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from fol…
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:21:38.467Z. Updated 2026-10-27T17:21:38.467Z.
oretnom23 php-travel-agency-system traceapplication.php sql injection
A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The exploit has been relea…
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:15:14.553Z. Updated 2026-10-28T16:14:08.352Z.
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh …
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T17:11:12.744Z. Updated 2026-10-27T17:11:12.744Z.