Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 2641–2660 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 20 Mar 2026, 07:29 WIB

CVE-2026-32771

Monitoring is vulnerable to Archive Slip due to missing checks in sanitization

The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). In versions prior to 0.2.2, the sanitizeArchivePath function in pkg/extract/extract.go (lines 248–254) is vulnerable to Path Traversal due to a missing trailing path sepa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:29:23.804Z. Updated 2026-03-20T16:45:32.747Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated20 Mar 2026, 23:45 WIB

Official record

HighPublished 20 Mar 2026, 07:18 WIB

CVE-2026-32769

Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a subverted application to any Pod out of the origin namespace. The flawed inter-ns NetworkPolicy breaks the security-by-default property expected…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2641 to 2660 of 6236.First page Next page

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:18:55.991Z. Updated 2026-03-20T20:01:28.750Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated21 Mar 2026, 03:01 WIB

Official record

CritPublished 20 Mar 2026, 07:13 WIB

CVE-2026-32767

SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the method parameter is set to 2, the endpoint passes user-supplied input directly as a raw SQL statement to the underlying SQLite database witho…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:13:31.384Z. Updated 2026-03-20T14:42:49.764Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Mar 2026, 21:42 WIB

Official record

LowPublished 20 Mar 2026, 07:07 WIB

CVE-2026-32766

astral-tokio-tar insufficiently validates PAX extensions during extraction

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for examp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:07:36.444Z. Updated 2026-03-20T18:09:06.340Z.

CVSS1.7v4.0KEVNot listedEPSSPresentUpdated21 Mar 2026, 01:09 WIB

Official record

CritPublished 20 Mar 2026, 07:06 WIB

CVE-2026-32985

Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution

Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass authentication checks in t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:06:28.759Z. Updated 2026-07-14T18:40:11.246Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:40 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2024-44722

CVE-2024-44722

SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T13:06:41.467Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 20:06 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2025-46597

CVE-2025-46597

Bitcoin Core 0.13.0 through 29.x has an integer overflow.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T13:49:19.162Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 20:49 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2025-46598

CVE-2025-46598

Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T13:47:22.888Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 20:47 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2025-55988

CVE-2025-55988

An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T14:19:41.703Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 21:19 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2025-63260

CVE-2025-63260

SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-07-05T01:31:38.394Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:31 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2025-63261

CVE-2025-63261

AWStats 8.0 is vulnerable to Command Injection via the open function

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-25T22:10:36.546Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2026, 05:10 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2025-67260

CVE-2025-67260

The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack TpkWebGIS Client 1.0.0.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-07-05T16:15:09.967Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:15 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2026-29828

CVE-2026-29828

DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T13:59:57.348Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 20:59 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2026-30578

CVE-2026-30578

File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "dir" parameter of the GET request to invoke arbitrary javascript code.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T14:06:08.500Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 21:06 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2026-30579

CVE-2026-30579

File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "upload file" functionality to upload a file with a crafted file name used to trigger a Javascript payload.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T14:07:00.510Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 21:07 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2026-30580

CVE-2026-30580

File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read arbitrary files on the target system.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T14:07:54.003Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 21:07 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2026-33368

CVE-2026-33368

Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest). The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious JavaScript into a crafted URL. When a vic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T13:22:23.589Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 20:22 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2026-33369

CVE-2026-33369

Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a FolderAction operation. The application fails to properly sanitize user-supplied input before incorporating it into an LDAP search filter. An authenticated attacker can exploit this issue by sending a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T13:36:25.874Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 20:36 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2026-33370

CVE-2026-33370

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Zimbra Briefcase feature due to insufficient sanitization of specific uploaded file types. When a user opens a publicly shared Briefcase file containing malicious scripts, the embedded Ja…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T13:38:46.271Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 20:38 WIB

Official record

UnscoredPublished 20 Mar 2026, 07:00 WIB

CVE-2026-33371

CVE-2026-33371

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacker can submit crafted XML data that is processed by an XML parser with external en…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-20T00:00:00.000Z. Updated 2026-03-23T13:39:46.789Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Mar 2026, 20:39 WIB

Official record