Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1341–1360 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

UnscoredPublished 29 Sep 2026, 01:40 WIB

CVE-2026-84894

CVE-2026-84894

In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T18:40:55.707Z. Updated 2026-09-30T15:05:50.817Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:05 WIB

Official record

CritPublished 29 Sep 2026, 01:39 WIB

CVE-2026-101108

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1341 to 1360 of 14934.First page Next page

Published 2026-09-28T18:39:32.085Z. Updated 2026-09-30T15:06:14.221Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:06 WIB

Official record

MedPublished 29 Sep 2026, 01:30 WIB

CVE-2026-101131

deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of the component dsh. The manipulation of the argument E2B_API_KEY leads to reliance on untrusted inputs in a security decision. Local access is required to approach…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T18:30:14.509Z. Updated 2026-09-28T18:47:04.009Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:47 WIB

Official record

MedPublished 29 Sep 2026, 01:15 WIB

CVE-2026-101105

code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofile_form of the file /create_profile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried out remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T18:15:13.356Z. Updated 2026-10-15T19:57:05.773Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated16 Oct 2026, 02:57 WIB

Official record

MedPublished 29 Sep 2026, 01:00 WIB

CVE-2026-101102

deepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox

A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function run_code of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state the worker is "contain…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T18:00:07.284Z. Updated 2026-10-01T14:49:20.774Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:49 WIB

Official record

CritPublished 29 Sep 2026, 00:55 WIB

CVE-2026-49994

Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/* handlers (settings, devices, groups, per-device endpoints including /api/device/{mac}/notes) called no auth check at all. A network attacker reach…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:55:28.805Z. Updated 2026-09-28T19:16:15.444Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 02:16 WIB

Official record

HighPublished 29 Sep 2026, 00:52 WIB

CVE-2026-55160

Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata endpoints (e.g. AWS I…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:52:24.490Z. Updated 2026-09-28T18:35:30.003Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:35 WIB

Official record

MedPublished 29 Sep 2026, 00:49 WIB

CVE-2026-101913

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:49:02.657Z. Updated 2026-09-28T18:38:42.684Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:38 WIB

Official record

MedPublished 29 Sep 2026, 00:48 WIB

CVE-2026-55156

Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication middleware — any network-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:48:21.086Z. Updated 2026-09-28T18:11:38.212Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:11 WIB

Official record

HighPublished 29 Sep 2026, 00:48 WIB

CVE-2026-55157

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:48:16.422Z. Updated 2026-10-01T14:47:57.868Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:47 WIB

Official record

MedPublished 29 Sep 2026, 00:48 WIB

CVE-2026-101912

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:48:06.990Z. Updated 2026-09-28T19:13:25.495Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 02:13 WIB

Official record

MedPublished 29 Sep 2026, 00:46 WIB

CVE-2026-101911

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:46:52.711Z. Updated 2026-10-01T14:46:01.003Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:46 WIB

Official record

MedPublished 29 Sep 2026, 00:45 WIB

CVE-2026-101910

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decisi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:45:27.675Z. Updated 2026-09-28T18:12:34.050Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:12 WIB

Official record

MedPublished 29 Sep 2026, 00:45 WIB

CVE-2026-101101

ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception

A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-08 is capable of addres…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:45:11.629Z. Updated 2026-09-28T18:13:33.954Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:13 WIB

Official record

HighPublished 29 Sep 2026, 00:42 WIB

CVE-2026-101909

Axios: Prototype Pollution Gadget in axios toFormData Options

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTok…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:42:40.203Z. Updated 2026-10-01T14:44:46.040Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:44 WIB

Official record

HighPublished 29 Sep 2026, 00:41 WIB

CVE-2026-75600

FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator accepts an authenticated …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:41:41.633Z. Updated 2026-09-29T15:34:11.672Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:34 WIB

Official record

HighPublished 29 Sep 2026, 00:41 WIB

CVE-2026-54710

FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)

FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privileges of the web server …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:41:01.240Z. Updated 2026-09-29T15:33:58.932Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:33 WIB

Official record

HighPublished 29 Sep 2026, 00:40 WIB

CVE-2026-54708

Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module

FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup file…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:40:43.836Z. Updated 2026-09-29T15:33:44.408Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:33 WIB

Official record

HighPublished 29 Sep 2026, 00:40 WIB

CVE-2026-54675

FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE). Authentication with a known username …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:40:21.519Z. Updated 2026-09-28T18:14:02.788Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:14 WIB

Official record

MedPublished 29 Sep 2026, 00:38 WIB

CVE-2026-101908

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.header…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-28T17:38:55.303Z. Updated 2026-09-28T18:15:41.687Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:15 WIB

Official record