Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2441–2460 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 25 Oct 2026, 23:50 WIB

CVE-2026-115817

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T16:50:33.914Z. Updated 2026-10-25T16:50:33.914Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Oct 2026, 23:50 WIB

Official record

MedPublished 25 Oct 2026, 23:30 WIB

CVE-2026-116060

SourceCodester Performance Indicator System adddealer.php sql injection

A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be util…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2441 to 2460 of 16156.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T16:30:18.104Z. Updated 2026-10-26T16:39:45.412Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:39 WIB

Official record

MedPublished 25 Oct 2026, 23:00 WIB

CVE-2026-116058

Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection

A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file JuelScriptEngine.java. Performing a manipulation results in code injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T16:00:08.867Z. Updated 2026-10-25T16:00:08.867Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 23:00 WIB

Official record

MedPublished 25 Oct 2026, 22:30 WIB

CVE-2026-116057

KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload

A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T15:30:13.590Z. Updated 2026-10-25T15:30:13.590Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 22:30 WIB

Official record

MedPublished 25 Oct 2026, 22:15 WIB

CVE-2026-116056

KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T15:15:13.191Z. Updated 2026-10-26T16:40:18.242Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:40 WIB

Official record

MedPublished 25 Oct 2026, 21:45 WIB

CVE-2026-116055

SourceCodester Performance Indicator System deleteproduct.php sql injection

A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T14:45:17.375Z. Updated 2026-10-25T14:45:17.375Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 21:45 WIB

Official record

LowPublished 25 Oct 2026, 21:15 WIB

CVE-2026-116054

SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash

A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T14:15:11.104Z. Updated 2026-10-25T14:15:11.104Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 21:15 WIB

Official record

MedPublished 25 Oct 2026, 20:30 WIB

CVE-2026-116053

dbcli mycli Whitelist source.py source_special_command_is_safe os command injection

A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:30:09.456Z. Updated 2026-10-26T16:40:46.983Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:40 WIB

Official record

LowPublished 25 Oct 2026, 20:22 WIB

CVE-2026-116186

OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:22:10.154Z. Updated 2026-10-25T13:22:10.154Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:22 WIB

Official record

MedPublished 25 Oct 2026, 20:22 WIB

CVE-2026-116185

OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:22:09.474Z. Updated 2026-10-25T13:22:09.474Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:22 WIB

Official record

LowPublished 25 Oct 2026, 20:22 WIB

CVE-2026-116184

OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:22:08.792Z. Updated 2026-10-25T13:22:08.792Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:22 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116211

YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:38.819Z. Updated 2026-10-25T13:20:38.819Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116208

YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:38.152Z. Updated 2026-10-25T13:20:38.152Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116207

YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:37.473Z. Updated 2026-10-26T16:41:15.236Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:41 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116206

YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:36.803Z. Updated 2026-10-25T13:20:36.803Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116205

YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:35.879Z. Updated 2026-10-25T13:20:35.879Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116204

YesWiki before 4.7.0 CSRF via despam Admin Action

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:35.206Z. Updated 2026-10-25T13:20:35.206Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116203

YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the allow_raw_html gate, executing JavaScript for every page view…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:34.532Z. Updated 2026-10-26T16:41:41.933Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:41 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116202

YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries API, which is served as image/svg+xml and executes script fo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:33.851Z. Updated 2026-10-25T13:20:33.851Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116201

Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:33.187Z. Updated 2026-10-25T13:20:33.187Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record