Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1301–1320 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 29 Sep 2026, 03:29 WIB

CVE-2026-102270

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounde…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:29:24.479Z. Updated 2026-09-29T19:36:54.944Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:36 WIB

Official record

MedPublished 29 Sep 2026, 03:27 WIB

CVE-2026-102269

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1301 to 1320 of 14934.First page Next page

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:27:54.521Z. Updated 2026-09-29T13:49:47.562Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 20:49 WIB

Official record

CritPublished 29 Sep 2026, 03:26 WIB

CVE-2026-102268

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:26:13.674Z. Updated 2026-09-29T13:59:11.421Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 20:59 WIB

Official record

HighPublished 29 Sep 2026, 03:23 WIB

CVE-2026-102267

PyJWT: PyJWKClient follows redirects when fetching JWKS

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:23:33.556Z. Updated 2026-10-01T14:56:29.970Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:56 WIB

Official record

HighPublished 29 Sep 2026, 03:21 WIB

CVE-2026-102266

PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:21:26.164Z. Updated 2026-09-29T19:35:42.049Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:35 WIB

Official record

HighPublished 29 Sep 2026, 03:16 WIB

CVE-2026-100392

InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator's user_type to 2 (Guest / read-on…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:16:19.121Z. Updated 2026-09-29T19:25:16.682Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:25 WIB

Official record

MedPublished 29 Sep 2026, 03:15 WIB

CVE-2026-102005

VxWorks Memory Allocation

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 26.09

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:15:52.709Z. Updated 2026-09-28T20:43:19.687Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 03:43 WIB

Official record

HighPublished 29 Sep 2026, 03:15 WIB

CVE-2026-100371

InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::change_password(), was added to address a previous authorization flaw that allowed a secondary administrator (user_type=1, user_id != 1) to directly change the password …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:15:17.155Z. Updated 2026-09-29T13:51:08.087Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 20:51 WIB

Official record

MedPublished 29 Sep 2026, 03:15 WIB

CVE-2026-101145

Eleveo Call Recording Software User Management userAddAction.do ldap injection

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly availab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:15:09.632Z. Updated 2026-10-20T22:44:19.391Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Oct 2026, 05:44 WIB

Official record

MedPublished 29 Sep 2026, 03:11 WIB

CVE-2026-101918

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:11:55.278Z. Updated 2026-09-29T13:57:29.516Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 20:57 WIB

Official record

MedPublished 29 Sep 2026, 03:07 WIB

CVE-2026-101917

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values abs…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:07:44.237Z. Updated 2026-09-28T20:35:25.908Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 03:35 WIB

Official record

MedPublished 29 Sep 2026, 03:07 WIB

CVE-2026-100370

DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the literal substring onl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:07:09.470Z. Updated 2026-09-28T20:40:03.613Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 03:40 WIB

Official record

HighPublished 29 Sep 2026, 03:01 WIB

CVE-2026-101916

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authenticati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:01:53.640Z. Updated 2026-10-01T14:54:55.987Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:54 WIB

Official record

MedPublished 29 Sep 2026, 03:00 WIB

CVE-2026-101144

Eleveo Call Recording Software Query Builder searchAction.do access control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:00:07.419Z. Updated 2026-10-20T22:26:37.059Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Oct 2026, 05:26 WIB

Official record

LowPublished 29 Sep 2026, 03:00 WIB

CVE-2026-18416

Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)

The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing it against the op…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:00:02.425Z. Updated 2026-09-30T15:28:20.615Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

MedPublished 29 Sep 2026, 03:00 WIB

CVE-2026-18415

Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames

ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame_buf_pool, sized IEEE802154_MTU). In builds with CONFIG_NET_L2_IEEE802154_FRAGMENT enabled (the default whenever CONFIG_NET_6LO is set), the branch taken when 6LoWPAN fragmentation…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:00:01.312Z. Updated 2026-09-30T15:28:20.759Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

HighPublished 29 Sep 2026, 03:00 WIB

CVE-2026-18414

Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the buffer turns out to b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T20:00:00.133Z. Updated 2026-09-30T15:28:20.886Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

HighPublished 29 Sep 2026, 02:59 WIB

CVE-2026-18413

Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the buffer turns out to b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T19:59:58.873Z. Updated 2026-09-30T20:11:11.842Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

HighPublished 29 Sep 2026, 02:59 WIB

CVE-2026-16513

Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write

The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle and the sqes input array, but not the handle out-parameter. On the first loop iteration it executed *handle = sqe, storing the kernel address of the ne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T19:59:57.736Z. Updated 2026-09-30T20:11:11.980Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

HighPublished 29 Sep 2026, 02:50 WIB

CVE-2026-87741

ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset() check and fails open when the cp_a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T19:50:22.141Z. Updated 2026-09-29T19:21:50.286Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:21 WIB

Official record