Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1241–1260 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81095

Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a browser could therefore poin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:36.212Z. Updated 2026-08-29T11:48:10.092Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

CritPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81094

mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding flag was supplied, so a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1241 to 1260 of 12259.First page Next page

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:34.879Z. Updated 2026-08-29T11:48:09.437Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81093

Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a URL and inspected neit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:34.013Z. Updated 2026-08-29T11:48:08.801Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81092

mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's cross-origin default allo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:33.286Z. Updated 2026-08-29T11:48:08.125Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-81091

mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:32.568Z. Updated 2026-08-29T11:48:07.418Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-80211

FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the forgotten-password path in includes/current…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:31.799Z. Updated 2026-09-24T14:19:47.089Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-80210

FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms

FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:31.106Z. Updated 2026-09-24T14:19:46.129Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

MedPublished 27 Aug 2026, 21:50 WIB

CVE-2026-80209

Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION_DENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues into prisma.workspace…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:30.339Z. Updated 2026-09-24T14:19:45.153Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

HighPublished 27 Aug 2026, 21:50 WIB

CVE-2026-80208

APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:29.616Z. Updated 2026-09-24T14:19:44.181Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

MedPublished 27 Aug 2026, 21:50 WIB

CVE-2026-80207

APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so POS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:50:28.887Z. Updated 2026-09-24T14:19:43.245Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

MedPublished 27 Aug 2026, 21:42 WIB

CVE-2026-64896

T2000 open debug port

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:42:33.253Z. Updated 2026-08-27T19:31:48.139Z.

CVSS5.2v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:31 WIB

Official record

MedPublished 27 Aug 2026, 21:22 WIB

CVE-2026-80213

CVE-2026-80213

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire described a dif…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:22:23.495Z. Updated 2026-08-27T17:52:14.240Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:52 WIB

Official record

HighPublished 27 Aug 2026, 21:15 WIB

CVE-2026-80212

CVE-2026-80212

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a respo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:15:04.403Z. Updated 2026-08-27T19:33:58.773Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:33 WIB

Official record

CritPublished 27 Aug 2026, 21:11 WIB

CVE-2026-16279

Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T14:11:33.949Z. Updated 2026-09-08T05:45:18.068Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated08 Sep 2026, 12:45 WIB

Official record

CritPublished 27 Aug 2026, 20:50 WIB

CVE-2026-57499

Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The `ip_address` parameter is embedded directly into a shell …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T13:50:51.826Z. Updated 2026-08-27T18:13:20.708Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 01:13 WIB

Official record

MedPublished 27 Aug 2026, 20:42 WIB

CVE-2026-11754

User Enumeration in Seres Software's syWEB

Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T13:42:09.603Z. Updated 2026-08-27T19:38:48.131Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:38 WIB

Official record

MedPublished 27 Aug 2026, 20:39 WIB

CVE-2026-11747

Reflected XSS in Seres Software's syWEB

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T13:39:12.905Z. Updated 2026-08-27T19:34:27.882Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:34 WIB

Official record

MedPublished 27 Aug 2026, 20:36 WIB

CVE-2026-81827

Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process and be written to se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T13:36:19.087Z. Updated 2026-08-27T18:54:31.597Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 01:54 WIB

Official record

CritPublished 27 Aug 2026, 20:32 WIB

CVE-2026-81826

Flowintel Fails to Invalidate Active Sessions After Password Change

Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that attacker’s access. The se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T13:32:48.355Z. Updated 2026-08-27T19:34:55.872Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:34 WIB

Official record

MedPublished 27 Aug 2026, 20:25 WIB

CVE-2026-81820

Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; * attribute value; * attribute type; * comment; * first/last seen values; * IDS flag. Those values were concatenated directly into …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T13:25:08.712Z. Updated 2026-08-27T19:39:23.123Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:39 WIB

Official record