Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 2421–2440 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 17 Apr 2026, 01:14 WIB

CVE-2026-33084

DataEase has SQL Injection through its getFieldEnumObj Endpoint

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service layer directly transfers the user-supplied sort value to the sorting metadata DTO, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T18:14:07.316Z. Updated 2026-04-18T02:40:47.771Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:40 WIB

Official record

MedPublished 17 Apr 2026, 01:03 WIB

CVE-2025-43937

CVE-2025-43937

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed cred…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2421 to 2440 of 5813.First page Next page

Published 2026-04-16T18:03:08.750Z. Updated 2026-04-16T18:51:41.562Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated17 Apr 2026, 01:51 WIB

Official record

MedPublished 17 Apr 2026, 00:59 WIB

CVE-2025-43935

CVE-2025-43935

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T17:59:04.315Z. Updated 2026-04-16T19:38:28.840Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated17 Apr 2026, 02:38 WIB

Official record

MedPublished 17 Apr 2026, 00:54 WIB

CVE-2025-43883

CVE-2025-43883

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper check for unusual or exceptional conditions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T17:54:09.831Z. Updated 2026-04-18T02:39:20.246Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:39 WIB

Official record

HighPublished 17 Apr 2026, 00:52 WIB

CVE-2026-33083

DataEase has SQL Injection in Order By Clause

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the orderDirection parameter used in dataset-related endpoints including /de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset. The Order2SQLObj class directly assign…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T17:52:37.255Z. Updated 2026-04-16T19:39:25.443Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 02:39 WIB

Official record

HighPublished 17 Apr 2026, 00:39 WIB

CVE-2026-33082

DataEase: SQL Injection in v2 Dataset Export

DataEase is an open source data visualization analysis tool. Versions 2.10.20 and below contain a SQL injection vulnerability in the dataset export functionality. The expressionTree parameter in POST /de2api/datasetTree/exportDataset is deserialized into a filtering object and passed to WhereTree2Str.transFilterTrees f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T17:39:37.894Z. Updated 2026-04-16T18:41:46.111Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 01:41 WIB

Official record

HighPublished 17 Apr 2026, 00:32 WIB

CVE-2026-41082

CVE-2026-41082

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T17:32:40.068Z. Updated 2026-07-15T01:00:03.411Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:00 WIB

Official record

LowPublished 17 Apr 2026, 00:27 WIB

CVE-2026-27820

zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T17:27:48.944Z. Updated 2026-04-16T18:20:21.451Z.

CVSS1.7v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 01:20 WIB

Official record

MedPublished 17 Apr 2026, 00:08 WIB

CVE-2026-24749

Silverstripe Assets Module has a DBFile::getURL() permission bypass

The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2, images rendered in templates or otherwise accessed via DBFile::getURL() or DBFile::getSourceURL() incorrectly add an access grant to the current session, which bypasses file permissi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T17:08:59.133Z. Updated 2026-04-18T02:36:26.887Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:36 WIB

Official record

HighPublished 17 Apr 2026, 00:02 WIB

CVE-2026-2336

Weak webstax_auth Cookie Authentication Allows Privilege Escalation

A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T17:02:06.352Z. Updated 2026-04-16T17:34:39.672Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 00:34 WIB

Official record

LowPublished 16 Apr 2026, 23:52 WIB

CVE-2026-41080

CVE-2026-41080

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T16:52:01.177Z. Updated 2026-10-15T01:18:28.535Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:18 WIB

Official record

MedPublished 16 Apr 2026, 23:05 WIB

CVE-2025-36579

CVE-2025-36579

Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability, leading to unauthorized access.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T16:05:32.561Z. Updated 2026-05-27T16:34:39.110Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 23:34 WIB

Official record

UnscoredPublished 16 Apr 2026, 22:18 WIB

CVE-2026-5426

KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T15:18:46.224Z. Updated 2026-05-27T14:53:16.313Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 21:53 WIB

Official record

HighPublished 16 Apr 2026, 21:30 WIB

CVE-2026-3324

Authentication Bypass

Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T14:30:55.130Z. Updated 2026-04-16T15:21:19.911Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 22:21 WIB

Official record

HighPublished 16 Apr 2026, 21:30 WIB

CVE-2026-6409

Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T14:30:51.568Z. Updated 2026-04-16T15:24:43.164Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated16 Apr 2026, 22:24 WIB

Official record

MedPublished 16 Apr 2026, 21:10 WIB

CVE-2026-2840

Email Encoder – Protect Email Addresses and Phone Numbers <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via eeb_mailto Shortcode

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T14:10:29.114Z. Updated 2026-04-16T14:42:53.905Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 21:42 WIB

Official record

HighPublished 16 Apr 2026, 20:56 WIB

CVE-2026-33804

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass mid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T13:56:56.176Z. Updated 2026-04-16T14:41:48.659Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 21:41 WIB

Official record

HighPublished 16 Apr 2026, 20:46 WIB

CVE-2026-5785

SQL Injection

Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T13:46:28.313Z. Updated 2026-04-17T03:55:15.059Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated17 Apr 2026, 10:55 WIB

Official record

CritPublished 16 Apr 2026, 20:44 WIB

CVE-2026-6270

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T13:44:46.322Z. Updated 2026-04-16T14:24:26.764Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 21:24 WIB

Official record

UnscoredPublished 16 Apr 2026, 20:31 WIB

CVE-2026-31987

Apache Airflow: JWT token appearing in logs

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-16T13:31:52.336Z. Updated 2026-04-18T02:28:44.770Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:28 WIB

Official record