Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 241–260 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

LowPublished 31 Mar 2026, 07:54 WIB

CVE-2026-5115

Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices

The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking. The PaperCut NG/MF Embedded application is a software interface that runs directly on the touch screen of a multi-function device. It was internally discovered that the communication channel betwe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:54:48.889Z. Updated 2026-03-31T13:59:35.485Z.

CVSS3.6v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 20:59 WIB

Official record

HighPublished 31 Mar 2026, 07:46 WIB

CVE-2026-32734

baserCMS: Multiple vulnerabilities in baserCMS

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:46:43.317Z. Updated 2026-03-31T18:53:24.730Z.

Showing 241 to 260 of 6236.First page Next page

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:53 WIB

Official record

MedPublished 31 Mar 2026, 07:45 WIB

CVE-2026-30879

baserCMS: Cross-site scripting vulnerability in blog post

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This issue has been patched in version 5.2.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:45:50.416Z. Updated 2026-03-31T14:00:32.272Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:00 WIB

Official record

HighPublished 31 Mar 2026, 07:45 WIB

CVE-2026-30940

baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE

baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/bc-theme-file/theme_files/add.json) that allows arbitrary file write. An authenticated administrator can include ../ sequences in the path parameter to create a P…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:45:35.177Z. Updated 2026-04-02T14:46:54.107Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 21:46 WIB

Official record

MedPublished 31 Mar 2026, 07:45 WIB

CVE-2026-30878

baserCMS: Mail Form Acceptance Bypass via Public API

baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even when the corresponding form is not accepting submissions. This bypasses administrative controls intended to stop form intake and enables spam or abuse via the A…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:45:21.294Z. Updated 2026-03-31T19:09:18.507Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 02:09 WIB

Official record

CritPublished 31 Mar 2026, 07:45 WIB

CVE-2026-30877

baserCMS: OS Command Injection in the baserCMS Update Functionality

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account runn…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:45:09.718Z. Updated 2026-04-02T14:43:52.296Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 21:43 WIB

Official record

CritPublished 31 Mar 2026, 07:44 WIB

CVE-2026-30880

baserCMS: OS command injection vulnerability in installer

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. This issue has been patched in version 5.2.3.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:44:39.344Z. Updated 2026-03-31T15:27:21.969Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 22:27 WIB

Official record

MedPublished 31 Mar 2026, 07:44 WIB

CVE-2026-27697

baserCMS: SQL injection vulnerability in blog post

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in version 5.2.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:44:20.442Z. Updated 2026-03-31T15:28:00.580Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 22:28 WIB

Official record

CritPublished 31 Mar 2026, 07:43 WIB

CVE-2026-21861

baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to exec(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:43:58.296Z. Updated 2026-03-31T14:01:39.730Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:01 WIB

Official record

HighPublished 31 Mar 2026, 07:43 WIB

CVE-2025-32957

baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without validating or restricting the filename. An attacker can craft a maliciou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:43:48.908Z. Updated 2026-03-31T19:09:23.581Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 02:09 WIB

Official record

LowPublished 31 Mar 2026, 07:39 WIB

CVE-2026-4794

Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF

Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code via different UI fields. This could be used to compromise other admininistrator's sessions or perform unauthorized actions via the administrator's auth…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:39:56.135Z. Updated 2026-03-31T14:03:59.735Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:03 WIB

Official record

UnscoredPublished 31 Mar 2026, 07:00 WIB

CVE-2026-29870

CVE-2026-29870

A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file writes via the checkpoint_dir parameter in OfflineACE.run. The save_to_file method in ace/skillbook.py fails to normalize or validate filesystem paths, allowing traversal sequences to escape the intended…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:00:00.000Z. Updated 2026-03-31T15:08:04.780Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Mar 2026, 22:08 WIB

Official record

UnscoredPublished 31 Mar 2026, 07:00 WIB

CVE-2026-30276

CVE-2026-30276

An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:00:00.000Z. Updated 2026-04-01T18:16:00.742Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2026, 01:16 WIB

Official record

UnscoredPublished 31 Mar 2026, 07:00 WIB

CVE-2026-30277

CVE-2026-30277

An arbitrary file overwrite vulnerability in PDF Reader App : TA/UTAX Mobile Print v3.7.2.251001 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:00:00.000Z. Updated 2026-07-05T01:30:06.463Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:30 WIB

Official record

UnscoredPublished 31 Mar 2026, 07:00 WIB

CVE-2026-30278

CVE-2026-30278

An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:00:00.000Z. Updated 2026-07-05T01:30:11.097Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:30 WIB

Official record

UnscoredPublished 31 Mar 2026, 07:00 WIB

CVE-2026-30279

CVE-2026-30279

An arbitrary file overwrite vulnerability in Squareapps LLC My Location Travel Timeline v11.80 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:00:00.000Z. Updated 2026-07-05T01:30:15.000Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:30 WIB

Official record

UnscoredPublished 31 Mar 2026, 07:00 WIB

CVE-2026-30280

CVE-2026-30280

An arbitrary file overwrite vulnerability in RAREPROB SOLUTIONS PRIVATE LIMITED Video player Play All Videos v1.0.135 allows attackers to overwrite critical internal files via the file import process, leading to arbtrary code execution or information exposure.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:00:00.000Z. Updated 2026-04-01T14:49:03.226Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Apr 2026, 21:49 WIB

Official record

UnscoredPublished 31 Mar 2026, 07:00 WIB

CVE-2026-30281

CVE-2026-30281

An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:00:00.000Z. Updated 2026-04-01T18:14:46.520Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2026, 01:14 WIB

Official record

UnscoredPublished 31 Mar 2026, 07:00 WIB

CVE-2026-30282

CVE-2026-30282

An arbitrary file overwrite vulnerability in UXGROUP LLC Cast to TV Screen Mirroring v2.2.77 allows attackers to overwrite critical internal files via the file import process, leading to arbtrary code execution or information exposure.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:00:00.000Z. Updated 2026-07-05T01:30:19.170Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:30 WIB

Official record

UnscoredPublished 31 Mar 2026, 07:00 WIB

CVE-2026-30283

CVE-2026-30283

An arbitrary file overwrite vulnerability in PEAKSEL D.O.O. NIS Animal Sounds and Ringtones v1.3.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T00:00:00.000Z. Updated 2026-07-05T01:30:23.581Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:30 WIB

Official record