Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2641–2660 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

CritPublished 24 Oct 2026, 04:23 WIB

CVE-2026-115889

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference inco…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T21:23:27.669Z. Updated 2026-10-26T17:42:15.319Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:42 WIB

Official record

HighPublished 24 Oct 2026, 04:19 WIB

CVE-2026-115887

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2641 to 2660 of 16156.First page Next page

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T21:19:42.561Z. Updated 2026-10-23T21:19:42.561Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 04:19 WIB

Official record

MedPublished 24 Oct 2026, 04:17 WIB

CVE-2026-115886

MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Score…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T21:17:21.462Z. Updated 2026-10-23T21:17:21.462Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 04:17 WIB

Official record

MedPublished 24 Oct 2026, 04:15 WIB

CVE-2026-115885

LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI log…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T21:15:09.944Z. Updated 2026-10-29T14:43:01.864Z.

CVSS4.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 21:43 WIB

Official record

MedPublished 24 Oct 2026, 04:12 WIB

CVE-2026-115883

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with ".".join(namespace)…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T21:12:34.523Z. Updated 2026-10-26T17:42:32.027Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:42 WIB

Official record

UnscoredPublished 24 Oct 2026, 03:57 WIB

CVE-2026-113951

CVE-2026-113951

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:57:20.150Z. Updated 2026-10-23T20:57:20.150Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:57 WIB

Official record

MedPublished 24 Oct 2026, 03:42 WIB

CVE-2026-75525

OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. The product's design guar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:42:21.394Z. Updated 2026-10-23T20:42:21.394Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:42 WIB

Official record

MedPublished 24 Oct 2026, 03:30 WIB

CVE-2026-115800

UbiquitousLearning mllm Convertor __init__.py load_model path traversal

A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:30:23.839Z. Updated 2026-10-26T17:42:38.515Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:42 WIB

Official record

MedPublished 24 Oct 2026, 03:29 WIB

CVE-2026-75524

OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the numbe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:29:52.583Z. Updated 2026-10-29T14:33:55.695Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 21:33 WIB

Official record

HighPublished 24 Oct 2026, 03:29 WIB

CVE-2026-65825

OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:29:17.174Z. Updated 2026-10-26T17:45:38.981Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:45 WIB

Official record

HighPublished 24 Oct 2026, 03:27 WIB

CVE-2026-65824

OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that acco…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:27:52.852Z. Updated 2026-10-23T20:27:52.852Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:27 WIB

Official record

HighPublished 24 Oct 2026, 03:27 WIB

CVE-2026-58202

OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:27:36.090Z. Updated 2026-10-23T20:27:36.090Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:27 WIB

Official record

MedPublished 24 Oct 2026, 03:25 WIB

CVE-2026-115877

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Leng…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:25:12.031Z. Updated 2026-10-29T14:23:05.736Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 21:23 WIB

Official record

LowPublished 24 Oct 2026, 03:21 WIB

CVE-2026-83813

Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:21:54.364Z. Updated 2026-10-23T20:21:54.364Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:21 WIB

Official record

HighPublished 24 Oct 2026, 03:20 WIB

CVE-2026-115778

Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:20:34.591Z. Updated 2026-10-23T20:55:34.866Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:55 WIB

Official record

HighPublished 24 Oct 2026, 03:18 WIB

CVE-2026-115776

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inher…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:18:38.342Z. Updated 2026-10-23T20:18:38.342Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:18 WIB

Official record

HighPublished 24 Oct 2026, 03:16 WIB

CVE-2026-115775

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:16:29.913Z. Updated 2026-10-23T20:16:29.913Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:16 WIB

Official record

MedPublished 24 Oct 2026, 03:14 WIB

CVE-2026-115774

Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size mo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:14:07.480Z. Updated 2026-10-29T14:20:15.738Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 21:20 WIB

Official record

UnscoredPublished 24 Oct 2026, 03:07 WIB

CVE-2026-113877

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:07:20.677Z. Updated 2026-10-23T23:06:45.441Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Oct 2026, 06:06 WIB

Official record

MedPublished 24 Oct 2026, 03:00 WIB

CVE-2026-115797

Tenda F6 Web Management cleartext transmission

A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high compl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T20:00:16.370Z. Updated 2026-10-29T14:19:14.179Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 21:19 WIB

Official record