Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1221–1240 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81687

openssl_encrypt before 1.4.9 Denial of Service via KDF

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:51.786Z. Updated 2026-10-01T15:21:21.447Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

MedPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81686

openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1221 to 1240 of 12259.First page Next page

Published 2026-08-27T14:50:51.068Z. Updated 2026-10-01T15:21:20.770Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

CritPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81685

openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata

openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:50.345Z. Updated 2026-10-01T15:21:20.159Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

MedPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81684

openssl_encrypt before 1.4.9 Information Disclosure via Command Line

In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main password. Any local user ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:49.620Z. Updated 2026-10-01T15:21:19.480Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81683

openssl_encrypt before 1.4.9 Plaintext Private Key Storage

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the expos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:48.886Z. Updated 2026-10-01T15:21:18.855Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81682

openssl_encrypt before 1.4.9 Insecure File Permissions

openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:48.168Z. Updated 2026-10-01T15:21:18.201Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

CritPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81681

openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:47.408Z. Updated 2026-10-01T15:21:17.594Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

CritPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81680

openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal

openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silently removing recovery p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:46.683Z. Updated 2026-10-01T15:21:16.940Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81679

OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET reque…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:45.924Z. Updated 2026-10-08T15:51:44.741Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:51 WIB

Official record

MedPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81678

AVideo SSRF Guard Bypass via IPv6 Transition Addresses

AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal servi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:45.173Z. Updated 2026-08-29T11:48:15.601Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

MedPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81664

OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:43.397Z. Updated 2026-08-31T15:55:11.644Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:55 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81335

Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits any caller, so a request carrying no credential reaches the han…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:42.684Z. Updated 2026-08-27T17:59:52.010Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:59 WIB

Official record

MedPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81334

darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser

darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknet_network.cpp as xcalloc(net.n, sizeof(Darknet::Layer)), sized to exactly the number of layer sections the file declares. The shortcut, scale_channels …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:41.973Z. Updated 2026-08-27T19:23:22.461Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:23 WIB

Official record

LowPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81102

Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback address still reache…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:41.263Z. Updated 2026-08-29T11:48:14.917Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

MedPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81101

Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted the environment-variab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:40.449Z. Updated 2026-08-29T11:48:14.223Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81100

Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making the locally reachable Gi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:39.728Z. Updated 2026-08-29T11:48:13.548Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81099

Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page in a browser could point…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:39.029Z. Updated 2026-08-29T11:48:12.861Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

CritPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81098

Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were absent, so a request …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:38.327Z. Updated 2026-08-29T11:48:12.176Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81097

rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape

The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:37.617Z. Updated 2026-08-29T11:48:11.453Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

CritPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81096

ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:36.897Z. Updated 2026-08-29T11:48:10.764Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record