Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2461–2480 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116200

Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()

Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:32.506Z. Updated 2026-10-25T13:20:32.506Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

CritPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116199

Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2461 to 2480 of 16156.First page Next page

Published 2026-10-25T13:20:31.815Z. Updated 2026-10-26T16:41:49.682Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:41 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116198

Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:31.140Z. Updated 2026-10-25T13:20:31.140Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

LowPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116197

Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:30.463Z. Updated 2026-10-25T13:20:30.463Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116196

Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:29.804Z. Updated 2026-10-25T13:20:29.804Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116195

Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:29.131Z. Updated 2026-10-26T16:42:00.376Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:42 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116194

Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:28.466Z. Updated 2026-10-25T13:20:28.466Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116193

Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace en…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:27.801Z. Updated 2026-10-25T13:20:27.801Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116192

rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:27.162Z. Updated 2026-10-25T13:20:27.162Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116191

Rclone before 1.75.2 Path Traversal via serve webdav MKCOL

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belongin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:26.490Z. Updated 2026-10-26T16:42:11.109Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:42 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116190

rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webd…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:25.832Z. Updated 2026-10-25T13:20:25.832Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116189

rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupd…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:25.148Z. Updated 2026-10-25T13:20:25.148Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116188

rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:24.506Z. Updated 2026-10-25T13:20:24.506Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116187

Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:23.849Z. Updated 2026-10-26T16:42:27.522Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:42 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116183

phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faq…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:21.213Z. Updated 2026-10-26T16:42:50.439Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:42 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116182

phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them and embed responses in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:20.563Z. Updated 2026-10-25T13:20:20.563Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116181

vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids

vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runn…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:19.874Z. Updated 2026-10-25T13:20:19.874Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116180

vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:19.199Z. Updated 2026-10-26T19:48:35.789Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:48 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116179

vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:18.520Z. Updated 2026-10-26T16:43:21.928Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:43 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116178

vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:17.838Z. Updated 2026-10-26T19:48:35.925Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:48 WIB

Official record