Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2501–2520 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116157

ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:03.602Z. Updated 2026-10-26T19:48:36.366Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:48 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116156

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2501 to 2520 of 16156.First page Next page

Published 2026-10-25T13:20:02.956Z. Updated 2026-10-26T19:48:36.513Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:48 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116155

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:02.349Z. Updated 2026-10-26T16:48:51.205Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:48 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116154

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:01.714Z. Updated 2026-10-26T19:58:39.363Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:58 WIB

Official record

LowPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116153

ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit

ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes or potential code exec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:01.069Z. Updated 2026-10-25T13:20:01.069Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:20 WIB

CVE-2026-116152

ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers can supply crafted MAT files that trigger this error path repeatedly, causing small memory leaks that gradually consume process memory.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:20:00.370Z. Updated 2026-10-25T13:20:00.370Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:20 WIB

Official record

MedPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116151

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:59.697Z. Updated 2026-10-26T16:49:17.981Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:49 WIB

Official record

LowPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116150

ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Attackers can submit crafted images for FPX encoding to leak memory repeatedly, causing resource exhaustion and denial of service.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:59.036Z. Updated 2026-10-26T19:58:39.505Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:58 WIB

Official record

HighPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116149

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:58.386Z. Updated 2026-10-25T13:19:58.386Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:19 WIB

Official record

MedPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116148

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the result…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:57.729Z. Updated 2026-10-25T13:19:57.729Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:19 WIB

Official record

MedPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116147

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process and causes a denial of…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:57.089Z. Updated 2026-10-26T16:49:43.897Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:49 WIB

Official record

MedPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116146

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:56.440Z. Updated 2026-10-26T19:58:39.647Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:58 WIB

Official record

LowPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116145

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j. An attacker able to supply input to ImageMagick can evade configured security policy restrictions, allowing operations the policy was intended to bloc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:55.780Z. Updated 2026-10-25T13:19:55.780Z.

CVSS1.8v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:19 WIB

Official record

MedPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116144

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:55.066Z. Updated 2026-10-26T19:58:39.787Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:58 WIB

Official record

MedPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116143

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMagick to process more scenes than permitted, potentially exhaus…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:54.384Z. Updated 2026-10-26T16:50:00.144Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:50 WIB

Official record

MedPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116142

ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box

ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:53.714Z. Updated 2026-10-25T13:19:53.714Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:19 WIB

Official record

MedPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116141

ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder

ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, cau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:53.057Z. Updated 2026-10-25T13:19:53.057Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:19 WIB

Official record

MedPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116140

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked progra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:52.372Z. Updated 2026-10-25T13:19:52.372Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:19 WIB

Official record

MedPublished 25 Oct 2026, 20:19 WIB

CVE-2026-116139

WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering

WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML() preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerror handler, which bypa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T13:19:51.674Z. Updated 2026-10-26T16:52:45.479Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:52 WIB

Official record

MedPublished 25 Oct 2026, 19:15 WIB

CVE-2026-116052

LinkStackOrg LinkStack cross-site request forgery

A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T12:15:10.995Z. Updated 2026-10-29T16:03:53.631Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 23:03 WIB

Official record