Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 2641–2660 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 25 Aug 2026, 03:33 WIB

CVE-2026-77634

CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in mess…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:33:46.836Z. Updated 2026-08-25T19:23:40.053Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:23 WIB

Official record

MedPublished 25 Aug 2026, 03:32 WIB

CVE-2026-5006

Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include slash ({{/}}) chara…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2641 to 2660 of 12259.First page Next page

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:32:49.396Z. Updated 2026-08-26T03:56:14.745Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 10:56 WIB

Official record

CritPublished 25 Aug 2026, 03:30 WIB

CVE-2026-77635

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:30:34.492Z. Updated 2026-08-25T13:31:40.225Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 20:31 WIB

Official record

LowPublished 25 Aug 2026, 03:15 WIB

CVE-2026-75554

Explicit organization scopes survive token refresh after membership ends

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:<org> …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:15:05.791Z. Updated 2026-08-25T19:53:55.535Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:53 WIB

Official record

HighPublished 25 Aug 2026, 03:14 WIB

CVE-2026-75542

OAuth token exchange grants repository scopes for organizations the principal cannot access

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:14:30.191Z. Updated 2026-08-25T19:53:26.196Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:53 WIB

Official record

HighPublished 25 Aug 2026, 03:10 WIB

CVE-2026-77567

Filament: App-based MFA can be bypassed when recovery codes are enabled

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:10:58.326Z. Updated 2026-08-27T14:17:29.291Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:17 WIB

Official record

MedPublished 25 Aug 2026, 03:08 WIB

CVE-2026-72714

Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps its own copy which is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:08:33.917Z. Updated 2026-10-26T01:23:58.366Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 08:23 WIB

Official record

MedPublished 25 Aug 2026, 03:08 WIB

CVE-2026-72711

Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add_opaque omits the check_no_metavar_no_fvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A metaprogram can first …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:08:33.219Z. Updated 2026-10-26T01:23:57.370Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 08:23 WIB

Official record

MedPublished 25 Aug 2026, 03:08 WIB

CVE-2026-72705

Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function to a plain definition is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:08:32.535Z. Updated 2026-10-26T01:23:56.439Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 08:23 WIB

Official record

MedPublished 25 Aug 2026, 03:08 WIB

CVE-2026-72704

Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport

The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by transport. A fixpoint may apply a rewrite along an equality between types to its recursive argument, which the guard checker accepts because the inductive type is p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:08:31.787Z. Updated 2026-10-26T01:23:55.463Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 08:23 WIB

Official record

MedPublished 25 Aug 2026, 03:08 WIB

CVE-2026-72703

Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls

The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoint. find_uniform_parameters in kernel/inductive.ml inspects only self-recursive calls, so when no body calls itself the function concludes that every parameter is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:08:30.607Z. Updated 2026-10-26T01:23:54.511Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 08:23 WIB

Official record

MedPublished 25 Aug 2026, 03:08 WIB

CVE-2020-37268

Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built under Unset Universe Ch…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:08:28.079Z. Updated 2026-10-26T01:23:51.685Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 08:23 WIB

Official record

MedPublished 25 Aug 2026, 03:08 WIB

CVE-2026-75509

joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:08:07.088Z. Updated 2026-08-25T16:42:19.769Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:42 WIB

Official record

HighPublished 25 Aug 2026, 03:05 WIB

CVE-2026-76098

Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T20:05:00.932Z. Updated 2026-08-24T20:17:07.057Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 03:17 WIB

Official record

LowPublished 25 Aug 2026, 02:53 WIB

CVE-2026-76816

Netty: MQTT Topic Name and Client ID Validation Bypass

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and potentially causing ro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T19:53:12.737Z. Updated 2026-08-25T13:34:51.567Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 20:34 WIB

Official record

MedPublished 25 Aug 2026, 02:45 WIB

CVE-2026-78430

sworddut mcp-ffmpeg-helper Tool handlers.ts handleToolCall os command injection

A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the component Tool Handler. The manipulation of the argument format results in os command injection. Attacking locally is a requirement. The exploit is now public a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T19:45:08.359Z. Updated 2026-08-24T19:58:40.163Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:58 WIB

Official record

MedPublished 25 Aug 2026, 02:40 WIB

CVE-2026-63693

CVE-2026-63693

Dell Client BIOS contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Write

Excerpt language: en.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T19:40:03.175Z. Updated 2026-08-27T14:36:28.474Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:36 WIB

Official record

CritPublished 25 Aug 2026, 02:38 WIB

CVE-2026-78555

RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions. As a result, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T19:38:50.437Z. Updated 2026-08-24T20:05:50.104Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 03:05 WIB

Official record

HighPublished 25 Aug 2026, 02:28 WIB

CVE-2026-78553

Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access the RansomLook home dire…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T19:28:49.323Z. Updated 2026-08-24T20:07:07.041Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 03:07 WIB

Official record

MedPublished 25 Aug 2026, 02:24 WIB

CVE-2026-77310

jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T19:24:59.115Z. Updated 2026-08-25T19:23:52.205Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:23 WIB

Official record