Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 1261–1280 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 23 Apr 2026, 07:47 WIB

CVE-2026-41208

Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host. An attacker wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:47:45.824Z. Updated 2026-04-23T14:46:01.107Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated23 Apr 2026, 21:46 WIB

Official record

MedPublished 23 Apr 2026, 07:42 WIB

CVE-2026-41206

PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. The plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. Prior to version 0.1.8, the blocklist implemented in `PluginSecurity.vali…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1261 to 1280 of 5813.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:42:49.204Z. Updated 2026-04-23T16:23:33.759Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Apr 2026, 23:23 WIB

Official record

HighPublished 23 Apr 2026, 07:40 WIB

CVE-2026-41200

STIG Manager has reflected XSS vulnerability in the Web App

STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scripting (XSS) vulnerability in the OIDC authentication error handling code in `src/init.js` and `public/reauth.html`. During…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:40:23.187Z. Updated 2026-04-23T13:59:46.539Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated23 Apr 2026, 20:59 WIB

Official record

CritPublished 23 Apr 2026, 07:35 WIB

CVE-2026-41197

Brillig: Heap corruption in foreign call results with nested tuple arrays

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed bl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:35:37.842Z. Updated 2026-04-25T03:55:38.608Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Apr 2026, 10:55 WIB

Official record

CritPublished 23 Apr 2026, 07:28 WIB

CVE-2026-41196

Luanti has a mod security sandbox escape

Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:28:56.716Z. Updated 2026-04-23T14:38:39.113Z.

CVSS9v4.0KEVNot listedEPSSPresentUpdated23 Apr 2026, 21:38 WIB

Official record

MedPublished 23 Apr 2026, 07:14 WIB

CVE-2026-41182

LangSmith SDK: Streaming token events bypass output redaction

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:14:20.964Z. Updated 2026-04-23T16:23:39.037Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated23 Apr 2026, 23:23 WIB

Official record

HighPublished 23 Apr 2026, 07:10 WIB

CVE-2026-41180

PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` validates the mounted request path using the still-encoded `req.path`, but the downstream tus handler later writes using the decoded `req.params.uploadId`. In deployments that use a s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:10:58.230Z. Updated 2026-04-23T13:59:14.836Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated23 Apr 2026, 20:59 WIB

Official record

MedPublished 23 Apr 2026, 07:09 WIB

CVE-2026-41243

OpenLearn's pending forum posts remain publicly readable by direct ID when moderation mode is enabled

OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when `safeMode` is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit 844b2a40a69d0c4911580fe50…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:09:03.863Z. Updated 2026-04-23T13:55:12.541Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Apr 2026, 20:55 WIB

Official record

CritPublished 23 Apr 2026, 07:03 WIB

CVE-2026-41179

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:03:36.282Z. Updated 2026-07-15T00:59:47.559Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 07:59 WIB

Official record

HighPublished 23 Apr 2026, 07:02 WIB

CVE-2026-32679

CVE-2026-32679

The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon Network Camera Plugin (CanonNWCamPlugin.exe and CanonNWCamPluginForAdmin.exe) insecurely load Dynamic Link Libraries (DLLs). If a malicious DLL is placed at the same directory, th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:02:05.301Z. Updated 2026-04-23T16:23:44.557Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated23 Apr 2026, 23:23 WIB

Official record

HighPublished 23 Apr 2026, 07:01 WIB

CVE-2026-40062

CVE-2026-40062

A path Traversal vulnerability exists in Ziostation2 v2.9.8.7 and earlier. A remote unauthenticated attacker may get sensitive information on the operating system.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:01:29.460Z. Updated 2026-04-23T16:23:52.670Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Apr 2026, 23:23 WIB

Official record

MedPublished 23 Apr 2026, 07:00 WIB

CVE-2026-6878

ByteDance verl grader.py math_equal sandbox

A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The manipulation leads to sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:00:20.300Z. Updated 2026-04-23T12:49:00.762Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated23 Apr 2026, 19:49 WIB

Official record

UnscoredPublished 23 Apr 2026, 07:00 WIB

CVE-2025-50229

CVE-2025-50229

Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:00:00.000Z. Updated 2026-04-24T18:33:51.153Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Apr 2026, 01:33 WIB

Official record

UnscoredPublished 23 Apr 2026, 07:00 WIB

CVE-2025-70994

CVE-2025-70994

Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic challenge-response mechanisms. This is vulnerable to signal forgery after a local a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:00:00.000Z. Updated 2026-04-23T15:10:43.811Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Apr 2026, 22:10 WIB

Official record

UnscoredPublished 23 Apr 2026, 07:00 WIB

CVE-2026-31159

CVE-2026-31159

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi-bin/cstecgi.cgi.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:00:00.000Z. Updated 2026-04-23T17:47:15.237Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 00:47 WIB

Official record

UnscoredPublished 23 Apr 2026, 07:00 WIB

CVE-2026-31160

CVE-2026-31160

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:00:00.000Z. Updated 2026-04-23T18:35:01.844Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 01:35 WIB

Official record

UnscoredPublished 23 Apr 2026, 07:00 WIB

CVE-2026-31162

CVE-2026-31162

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the ttlWay parameter to /cgi-bin/cstecgi.cgi.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:00:00.000Z. Updated 2026-04-23T19:03:15.466Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 02:03 WIB

Official record

UnscoredPublished 23 Apr 2026, 07:00 WIB

CVE-2026-31163

CVE-2026-31163

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the dhcpMtu parameter to /cgi-bin/cstecgi.cgi.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:00:00.000Z. Updated 2026-04-23T19:04:19.232Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 02:04 WIB

Official record

UnscoredPublished 23 Apr 2026, 07:00 WIB

CVE-2026-31164

CVE-2026-31164

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:00:00.000Z. Updated 2026-04-23T18:33:53.735Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 01:33 WIB

Official record

UnscoredPublished 23 Apr 2026, 07:00 WIB

CVE-2026-31165

CVE-2026-31165

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeServiceName parameter to /cgi-bin/cstecgi.cgi.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-23T00:00:00.000Z. Updated 2026-04-23T18:42:42.717Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Apr 2026, 01:42 WIB

Official record