Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2661–2680 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 24 Oct 2026, 02:56 WIB

CVE-2026-79982

Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BU…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:56:19.432Z. Updated 2026-10-23T19:56:19.432Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 02:56 WIB

Official record

MedPublished 24 Oct 2026, 02:56 WIB

CVE-2026-79981

DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_locked() -> register_dispatcher() -> dns_dispatcher_register()), with the local port left at 0 so the stack picks an ephemeral port exactly once. dns_write() then s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2661 to 2680 of 16156.First page Next page

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:56:18.319Z. Updated 2026-10-23T19:56:18.319Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 02:56 WIB

Official record

MedPublished 24 Oct 2026, 02:56 WIB

CVE-2026-79980

Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS

The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a per-transaction random value. It was seeded once with sys_rand32_get() in dhcpv4_start_internal(), incremented by one in dhcpv4_send_discover() and dhcpv4_send_decline(), an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:56:17.213Z. Updated 2026-10-23T19:56:17.213Z.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 02:56 WIB

Official record

HighPublished 24 Oct 2026, 02:56 WIB

CVE-2026-79979

Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames

The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidation only ever matched ASID 0 (the kernel page tables) and global entries. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:56:16.111Z. Updated 2026-10-23T19:56:16.111Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 02:56 WIB

Official record

LowPublished 24 Oct 2026, 02:56 WIB

CVE-2026-79978

Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path

The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len = MIN(fifo_bytes, buf_avail)) to the space actually returned by rtio_sqe_rx_buf(), but then queues one 6-byte bus read per hardware FIFO entry a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:56:14.995Z. Updated 2026-10-23T19:56:14.995Z.

CVSS3.6v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 02:56 WIB

Official record

HighPublished 24 Oct 2026, 02:56 WIB

CVE-2026-79977

WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the datagram's source add…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:56:13.873Z. Updated 2026-10-23T19:56:13.873Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 02:56 WIB

Official record

HighPublished 24 Oct 2026, 02:56 WIB

CVE-2026-19741

OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)

Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout the public OpenThread and Thread c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:56:12.805Z. Updated 2026-10-23T19:56:12.805Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 02:56 WIB

Official record

MedPublished 24 Oct 2026, 02:45 WIB

CVE-2026-115796

Tenda F6 Web Management cross-site request forgery

A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:45:19.860Z. Updated 2026-10-26T16:10:13.939Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:10 WIB

Official record

HighPublished 24 Oct 2026, 02:34 WIB

CVE-2026-115586

virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:34:46.391Z. Updated 2026-10-23T20:55:42.764Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:55 WIB

Official record

HighPublished 24 Oct 2026, 02:31 WIB

CVE-2026-115585

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:31:52.598Z. Updated 2026-10-23T19:31:52.598Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 02:31 WIB

Official record

HighPublished 24 Oct 2026, 02:29 WIB

CVE-2026-115580

pypdf: Possible long runtimes for large xref table header limits

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:29:49.845Z. Updated 2026-10-23T19:29:49.845Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 02:29 WIB

Official record

HighPublished 24 Oct 2026, 02:24 WIB

CVE-2026-115572

pypdf: Possible long runtimes for repeated references to the same missing object

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:24:51.055Z. Updated 2026-10-29T14:18:40.569Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 21:18 WIB

Official record

MedPublished 24 Oct 2026, 02:04 WIB

CVE-2026-115845

Incomplete validation in the run_script Python sandbox in AWS MCP Server

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T19:04:44.790Z. Updated 2026-10-23T19:04:44.790Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 02:04 WIB

Official record

HighPublished 24 Oct 2026, 01:33 WIB

CVE-2026-91093

HP One Agent Software – Security Update

A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T18:33:58.401Z. Updated 2026-10-29T10:45:48.007Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

HighPublished 24 Oct 2026, 01:15 WIB

CVE-2026-112342

Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning

Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T18:15:16.426Z. Updated 2026-10-27T10:14:04.889Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

HighPublished 24 Oct 2026, 01:13 WIB

CVE-2026-115570

Electron: Mitigation for compromised eMudhra intermediate certificates

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T18:13:53.961Z. Updated 2026-10-23T20:56:26.712Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:56 WIB

Official record

LowPublished 24 Oct 2026, 01:09 WIB

CVE-2026-115569

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T18:09:47.722Z. Updated 2026-10-23T18:09:47.722Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 01:09 WIB

Official record

HighPublished 24 Oct 2026, 00:35 WIB

CVE-2026-115863

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T17:35:18.517Z. Updated 2026-10-23T17:35:18.517Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 00:35 WIB

Official record

MedPublished 24 Oct 2026, 00:35 WIB

CVE-2026-115813

Server-side request forgery in the model download path in Amazon Web Services Multi Model Server

Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T17:35:14.102Z. Updated 2026-10-23T17:35:14.102Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 00:35 WIB

Official record

CritPublished 24 Oct 2026, 00:33 WIB

CVE-2026-115812

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T17:33:53.542Z. Updated 2026-10-23T17:33:53.542Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 00:33 WIB

Official record