Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1281–1300 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 29 Sep 2026, 04:00 WIB

CVE-2026-101188

Netcore POWER13 ubus routerd.passwd_set password recovery

A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was conta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T21:00:08.288Z. Updated 2026-10-01T15:03:53.564Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:03 WIB

Official record

LowPublished 29 Sep 2026, 03:59 WIB

CVE-2026-102279

Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1281 to 1300 of 14934.First page Next page

Published 2026-09-28T20:59:36.528Z. Updated 2026-09-29T14:44:03.594Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 21:44 WIB

Official record

HighPublished 29 Sep 2026, 03:57 WIB

CVE-2026-102278

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can appl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:57:09.850Z. Updated 2026-10-01T15:02:44.798Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:02 WIB

Official record

LowPublished 29 Sep 2026, 03:57 WIB

CVE-2026-97027

Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:57:06.758Z. Updated 2026-09-29T19:40:02.638Z.

CVSS3.6v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:40 WIB

Official record

LowPublished 29 Sep 2026, 03:57 WIB

CVE-2026-97026

Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path

Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:57:03.702Z. Updated 2026-09-30T20:11:11.704Z.

CVSS3.9v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

LowPublished 29 Sep 2026, 03:57 WIB

CVE-2026-97025

Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources (e.g. as used by Fedora) are…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:57:01.080Z. Updated 2026-09-29T15:59:42.565Z.

CVSS3.2v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:59 WIB

Official record

MedPublished 29 Sep 2026, 03:54 WIB

CVE-2026-102277

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:54:46.160Z. Updated 2026-09-29T19:38:56.637Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:38 WIB

Official record

HighPublished 29 Sep 2026, 03:50 WIB

CVE-2026-102276

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass ev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:50:59.984Z. Updated 2026-09-29T13:38:29.919Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 20:38 WIB

Official record

MedPublished 29 Sep 2026, 03:48 WIB

CVE-2026-102265

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:48:04.664Z. Updated 2026-10-01T15:01:31.377Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:01 WIB

Official record

MedPublished 29 Sep 2026, 03:46 WIB

CVE-2026-102006

VxWorks 7 Memory allocation

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:46:35.447Z. Updated 2026-09-30T13:42:51.624Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:42 WIB

Official record

MedPublished 29 Sep 2026, 03:46 WIB

CVE-2026-102275

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. A…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:46:33.169Z. Updated 2026-09-29T13:56:09.869Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 20:56 WIB

Official record

CritPublished 29 Sep 2026, 03:45 WIB

CVE-2026-101187

Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes command injection. The attack is possible to be carried out…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:45:07.763Z. Updated 2026-09-29T19:23:32.717Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:23 WIB

Official record

UnscoredPublished 29 Sep 2026, 03:44 WIB

CVE-2026-91096

CVE-2026-91096

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read callback that had been fre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:44:57.363Z. Updated 2026-09-30T19:47:55.479Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:47 WIB

Official record

UnscoredPublished 29 Sep 2026, 03:44 WIB

CVE-2026-91095

CVE-2026-91095

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of free…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:44:45.928Z. Updated 2026-09-30T19:49:15.429Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:49 WIB

Official record

UnscoredPublished 29 Sep 2026, 03:44 WIB

CVE-2026-84895

CVE-2026-84895

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:44:34.886Z. Updated 2026-10-01T14:02:23.724Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:02 WIB

Official record

MedPublished 29 Sep 2026, 03:42 WIB

CVE-2026-102274

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:42:28.355Z. Updated 2026-09-29T19:38:02.520Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:38 WIB

Official record

HighPublished 29 Sep 2026, 03:38 WIB

CVE-2026-102273

PyJWT accepts public JWK containers as HMAC secrets

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:38:28.161Z. Updated 2026-09-29T13:44:49.200Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 20:44 WIB

Official record

HighPublished 29 Sep 2026, 03:36 WIB

CVE-2026-102272

PyJWT BOM Bypass

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:36:31.530Z. Updated 2026-09-29T14:45:44.138Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 21:45 WIB

Official record

HighPublished 29 Sep 2026, 03:31 WIB

CVE-2026-102271

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:31:53.066Z. Updated 2026-10-01T14:57:42.294Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:57 WIB

Official record

MedPublished 29 Sep 2026, 03:30 WIB

CVE-2026-101146

Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure

A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService of the component GWT RPC Handler. Performing a manipulation results in information disclosure. The attack is possible t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:30:09.527Z. Updated 2026-10-20T22:44:38.165Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Oct 2026, 05:44 WIB

Official record