Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 2401–2420 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 17 Apr 2026, 04:59 WIB

CVE-2026-40249

free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT handler for updating Policy Data notification subscriptions at /nudr-dr/v2/policy-data/subs-to-notify/{subsId} does not return after request body retrieval or deserialization errors. Although HTTP 50…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T21:59:36.282Z. Updated 2026-04-18T02:47:28.094Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:47 WIB

Official record

HighPublished 17 Apr 2026, 04:57 WIB

CVE-2026-40248

free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the handler for creating or updating Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but does not return after sending the HTTP 404 response when validation…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2401 to 2420 of 5813.First page Next page

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T21:57:13.101Z. Updated 2026-04-20T15:00:17.552Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 22:00 WIB

Official record

HighPublished 17 Apr 2026, 04:54 WIB

CVE-2026-40247

free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the handler for reading Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but does not return after sending the HTTP 404 response when validation fails. Execu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T21:54:04.151Z. Updated 2026-04-17T18:44:09.831Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 01:44 WIB

Official record

HighPublished 17 Apr 2026, 04:40 WIB

CVE-2026-40246

free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions

free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the handler for deleting Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but does not return after sending the HTTP 404 response when validation fails. Exec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T21:40:03.598Z. Updated 2026-04-18T02:46:14.355Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:46 WIB

Official record

HighPublished 17 Apr 2026, 04:34 WIB

CVE-2026-40170

ngtcp2 has a qlog transport parameter serialization stack buffer overflow

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T21:34:07.610Z. Updated 2026-07-15T01:01:24.150Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:01 WIB

Official record

HighPublished 17 Apr 2026, 04:30 WIB

CVE-2026-40308

My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T21:30:52.401Z. Updated 2026-04-17T12:32:26.622Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 19:32 WIB

Official record

HighPublished 17 Apr 2026, 04:24 WIB

CVE-2026-39313

MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never enforced in readRequestB…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T21:24:27.328Z. Updated 2026-04-17T18:46:07.726Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 01:46 WIB

Official record

HighPublished 17 Apr 2026, 04:19 WIB

CVE-2026-35469

SpdyStream: DOS on CRI

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBloc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T21:19:23.516Z. Updated 2026-09-11T12:09:03.706Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated11 Sep 2026, 19:09 WIB

Official record

MedPublished 17 Apr 2026, 04:17 WIB

CVE-2026-34164

Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService

Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every incoming inbox message at INFO level. Inbox messages can contain highly sensitive information including personal data (PII), citizen identifiers (BSN), and case det…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T21:17:35.472Z. Updated 2026-04-18T02:44:44.369Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:44 WIB

Official record

MedPublished 17 Apr 2026, 04:12 WIB

CVE-2026-33472

Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)

Cryptomator is an open-source client-side encryption application for cloud storage. Version 1.19.1 contains a logic flaw in CheckHostTrustController.getAuthority() that allows an attacker to bypass the security fix for CVE-2026-32303. The method hardcodes the URI scheme based on port number, causing HTTPS URLs with por…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T21:12:37.076Z. Updated 2026-04-20T15:00:33.905Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated20 Apr 2026, 22:00 WIB

Official record

HighPublished 17 Apr 2026, 03:57 WIB

CVE-2026-40901

DataEase: Quartz Deserialization → Remote Code Execution

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializes job data BLOBs from …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T20:57:45.978Z. Updated 2026-04-17T18:47:00.448Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 01:47 WIB

Official record

HighPublished 17 Apr 2026, 03:53 WIB

CVE-2026-40900

DataEase has SQL Injection via Stacked Queries

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetData/previewSql endpoint. The user-supplied SQL is wrapped in a subquery without validation that the input is a single SELECT statement. Combined with the JDBC blo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T20:53:27.788Z. Updated 2026-04-17T12:38:32.676Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 19:38 WIB

Official record

HighPublished 17 Apr 2026, 02:48 WIB

CVE-2026-40899

DataEase has an Arbitrary File Read Vulnerability

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the illegalParameters field that contai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T19:48:44.201Z. Updated 2026-04-18T02:43:14.720Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:43 WIB

Official record

HighPublished 17 Apr 2026, 02:37 WIB

CVE-2026-33207

DataEase SQL Injection Vulnerability

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /datasource/getTableField endpoint. The getTableFiledSql method in CalciteProvider.java incorporates the tableName parameter directly into SQL query strings using String.format w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T19:37:36.197Z. Updated 2026-04-20T15:00:41.415Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 22:00 WIB

Official record

HighPublished 17 Apr 2026, 02:24 WIB

CVE-2026-33122

DataEase has SQL Injection via Datasource Management

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource update process. When a new table definition is added during a datasource update via /de2api/datasource/update, the deTableName field from the user-submitted config…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T19:24:03.195Z. Updated 2026-04-17T18:47:44.791Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 01:47 WIB

Official record

HighPublished 17 Apr 2026, 01:46 WIB

CVE-2025-54502

CVE-2025-54502

Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve privilege escalation potentially resulting in arbitrary code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T18:46:13.377Z. Updated 2026-07-15T01:26:07.627Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:26 WIB

Official record

MedPublished 17 Apr 2026, 01:44 WIB

CVE-2025-54510

CVE-2025-54510

A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with administrative privileges to alter MMIO routing on some Zen 5-based products, potentially compromising guest system integrity.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T18:44:10.182Z. Updated 2026-05-13T03:14:06.848Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated13 May 2026, 10:14 WIB

Official record

HighPublished 17 Apr 2026, 01:43 WIB

CVE-2026-6442

Improper Command Detection Logic Allows RCE in Cortex Code Command-Line Interface

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such as a malicious repository, causing the CLI agent to execute arbitrary c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T18:43:21.181Z. Updated 2026-04-16T18:54:58.366Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated17 Apr 2026, 01:54 WIB

Official record

MedPublished 17 Apr 2026, 01:42 WIB

CVE-2023-20585

CVE-2023-20585

Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T18:42:28.281Z. Updated 2026-04-16T19:12:06.991Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 02:12 WIB

Official record

HighPublished 17 Apr 2026, 01:16 WIB

CVE-2026-33121

DataEase has SQL Injection via Datasource Save Flow

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is used to construct a DDL statement via simple string replacement without a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T18:16:02.485Z. Updated 2026-04-16T18:34:54.187Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 01:34 WIB

Official record