Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2481–2500 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116177

vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-k…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:17.160Z. Updated 2026-10-25T13:20:17.160Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116176

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2481 to 2500 of 16156.First page Next page

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:16.476Z. Updated 2026-10-25T13:20:16.476Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116175

vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to hu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:15.794Z. Updated 2026-10-26T16:43:35.143Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:43 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116174

vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that te…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:15.109Z. Updated 2026-10-25T13:20:15.109Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116173

vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_id…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:14.431Z. Updated 2026-10-26T19:48:36.065Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:48 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116172

vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n

vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:13.759Z. Updated 2026-10-25T13:20:13.759Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116171

SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf fil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:13.056Z. Updated 2026-10-28T18:59:16.458Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116170

SiYuan before v3.8.7 SQL Injection via History Search op and query

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:12.378Z. Updated 2026-10-25T14:27:42.570Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 21:27 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116169

SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that mathRender assigns via inne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:11.710Z. Updated 2026-10-25T14:27:41.907Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 21:27 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116168

SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:11.054Z. Updated 2026-10-25T14:27:41.242Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 21:27 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116167

SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:10.372Z. Updated 2026-10-26T16:47:43.293Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:47 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116166

SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:09.700Z. Updated 2026-10-25T13:20:09.700Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

HighPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116165

Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remov…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:09.004Z. Updated 2026-10-25T13:20:09.004Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116164

Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or cl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:08.336Z. Updated 2026-10-25T13:20:08.336Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

CritPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116163

Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:07.658Z. Updated 2026-10-26T16:47:58.712Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:47 WIB

Official record

LowPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116162

Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:06.994Z. Updated 2026-10-25T13:20:06.994Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116161

Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated cl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:06.298Z. Updated 2026-10-25T13:20:06.298Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116160

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:05.634Z. Updated 2026-10-25T13:20:05.634Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116159

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:04.937Z. Updated 2026-10-26T16:48:24.183Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:48 WIB

Official record

LowPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116158

ImageMagick before 7.1.2-33 Memory Leak in magick compare

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

Excerpt language: en.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:04.263Z. Updated 2026-10-26T19:48:36.208Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:48 WIB

Official record