Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 121–140 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

CritPublished 01 Oct 2026, 00:22 WIB

CVE-2026-103475

yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:22:41.761Z. Updated 2026-09-30T19:13:28.143Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:13 WIB

Official record

HighPublished 01 Oct 2026, 00:22 WIB

CVE-2026-103474

yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 121 to 140 of 14934.First page Next page

Published 2026-09-30T17:22:41.048Z. Updated 2026-09-30T17:50:39.433Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:50 WIB

Official record

CritPublished 01 Oct 2026, 00:22 WIB

CVE-2026-103473

Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privilege…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:22:40.337Z. Updated 2026-10-02T16:27:05.332Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 23:27 WIB

Official record

HighPublished 01 Oct 2026, 00:22 WIB

CVE-2026-103472

restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering

restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through proc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:22:39.306Z. Updated 2026-10-01T18:00:00.791Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 01:00 WIB

Official record

HighPublished 01 Oct 2026, 00:22 WIB

CVE-2026-103471

restbed through 5.0.0 Denial of Service via Unbounded Header Buffering

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:22:38.624Z. Updated 2026-09-30T19:18:24.675Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:18 WIB

Official record

LowPublished 01 Oct 2026, 00:17 WIB

CVE-2026-103437

ReadingLists imported metadata permits JavaScript URL XSS

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

Excerpt language: en.

Severity low: primary CNA CVSS 1.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:17:35.540Z. Updated 2026-09-30T20:01:02.016Z.

CVSS1.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:01 WIB

Official record

UnscoredPublished 01 Oct 2026, 00:15 WIB

CVE-2026-103500

Heap buffer overflow opening large email

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:15:06.357Z. Updated 2026-10-21T17:24:51.272Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Oct 2026, 00:24 WIB

Official record

HighPublished 01 Oct 2026, 00:13 WIB

CVE-2026-103446

WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:13:02.339Z. Updated 2026-10-06T18:25:30.800Z.

CVSS7.4v4.0KEVNot listedEPSSPresentUpdated07 Oct 2026, 01:25 WIB

Official record

HighPublished 01 Oct 2026, 00:09 WIB

CVE-2026-53605

Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant

Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:09:23.367Z. Updated 2026-10-02T16:25:21.048Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated02 Oct 2026, 23:25 WIB

Official record

CritPublished 01 Oct 2026, 00:06 WIB

CVE-2026-55107

Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:06:00.286Z. Updated 2026-09-30T19:49:04.193Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:49 WIB

Official record

LowPublished 01 Oct 2026, 00:04 WIB

CVE-2026-103445

Stored XSS through PageForms #autoedit redirect links

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.

Excerpt language: en.

Severity low: primary CNA CVSS 1.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:04:14.711Z. Updated 2026-09-30T20:01:02.247Z.

CVSS1.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:01 WIB

Official record

HighPublished 01 Oct 2026, 00:01 WIB

CVE-2026-87004

Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verification

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoint using jose.jwt.get_unverified_claims() instead of jwt.deco…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:01:24.963Z. Updated 2026-09-30T18:01:20.063Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 01:01 WIB

Official record

CritPublished 30 Sep 2026, 23:59 WIB

CVE-2026-62308

Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a ur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T16:59:31.819Z. Updated 2026-09-30T19:27:22.748Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:27 WIB

Official record

CritPublished 30 Sep 2026, 23:58 WIB

CVE-2026-55494

Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py, the signature verifica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T16:58:27.259Z. Updated 2026-09-30T17:13:11.077Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:13 WIB

Official record

CritPublished 30 Sep 2026, 23:57 WIB

CVE-2026-55181

Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to /auth/oidc/login still starts th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T16:57:15.306Z. Updated 2026-09-30T19:50:41.889Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:50 WIB

Official record

MedPublished 30 Sep 2026, 23:45 WIB

CVE-2026-103241

vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T16:45:13.581Z. Updated 2026-10-02T16:23:50.737Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 23:23 WIB

Official record

CritPublished 30 Sep 2026, 23:30 WIB

CVE-2026-55176

Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth() and authenticateWorkspaceHttp() — accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying which workspace the call…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T16:30:42.729Z. Updated 2026-10-02T16:22:50.416Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated02 Oct 2026, 23:22 WIB

Official record

MedPublished 30 Sep 2026, 23:30 WIB

CVE-2026-103233

AdithyaYelloju Restaurant-Management-System Admin Area admin authorization

A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T16:30:09.762Z. Updated 2026-09-30T19:28:22.821Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:28 WIB

Official record

HighPublished 30 Sep 2026, 23:30 WIB

CVE-2026-46711

Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/<path>, /archive/<dir>) without any authentication or origin check. Any host that c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T16:30:02.745Z. Updated 2026-09-30T17:02:21.234Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:02 WIB

Official record

CritPublished 30 Sep 2026, 23:27 WIB

CVE-2026-75969

PTZOptics Missing Authentication in Firmware Upload

Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T16:27:51.490Z. Updated 2026-09-30T20:01:02.432Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:01 WIB

Official record