Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2681–2700 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 24 Oct 2026, 00:13 WIB

CVE-2026-115567

Tokio: Race condition in `tokio::time::Interval`

Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The race caused a use-aft…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T17:13:16.161Z. Updated 2026-10-23T17:13:16.161Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 00:13 WIB

Official record

HighPublished 24 Oct 2026, 00:10 WIB

CVE-2026-110975

Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure

A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration with no field-exclusi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2681 to 2700 of 16156.First page Next page

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T17:10:46.396Z. Updated 2026-10-23T20:56:51.255Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:56 WIB

Official record

HighPublished 23 Oct 2026, 23:15 WIB

CVE-2026-106069

CVE-2026-106069

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the WHATWG U…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:15:05.850Z. Updated 2026-10-23T16:15:05.850Z.

CVSS7.4v3.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 23:15 WIB

Official record

MedPublished 23 Oct 2026, 23:15 WIB

CVE-2026-105481

CVE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:15:05.837Z. Updated 2026-10-23T16:15:05.837Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 23:15 WIB

Official record

HighPublished 23 Oct 2026, 23:15 WIB

CVE-2026-105482

CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:15:05.831Z. Updated 2026-10-23T16:15:05.831Z.

CVSS7.4v3.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 23:15 WIB

Official record

MedPublished 23 Oct 2026, 23:15 WIB

CVE-2026-106074

CVE-2026-106074

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:15:05.829Z. Updated 2026-10-23T16:15:05.829Z.

CVSS4.8v3.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 23:15 WIB

Official record

LowPublished 23 Oct 2026, 23:15 WIB

CVE-2026-106071

CVE-2026-106071

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.6 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:15:05.791Z. Updated 2026-10-23T16:15:05.791Z.

CVSS3.6v3.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 23:15 WIB

Official record

MedPublished 23 Oct 2026, 23:15 WIB

CVE-2026-106072

CVE-2026-106072

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but no…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:15:05.783Z. Updated 2026-10-23T16:15:05.783Z.

CVSS6.7v3.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 23:15 WIB

Official record

HighPublished 23 Oct 2026, 23:15 WIB

CVE-2026-87901

CVE-2026-87901

Improper sanitization in the registration module allows reflected Cross-Site Scripting.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:15:05.780Z. Updated 2026-10-23T16:15:05.780Z.

CVSS8.3v3.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 23:15 WIB

Official record

HighPublished 23 Oct 2026, 23:15 WIB

CVE-2026-105483

CVE-2026-105483

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:15:05.773Z. Updated 2026-10-23T16:15:05.773Z.

CVSS7.4v3.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 23:15 WIB

Official record

LowPublished 23 Oct 2026, 23:15 WIB

CVE-2026-106070

CVE-2026-106070

A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:15:05.741Z. Updated 2026-10-23T16:15:05.741Z.

CVSS3.7v3.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 23:15 WIB

Official record

LowPublished 23 Oct 2026, 23:15 WIB

CVE-2026-106073

CVE-2026-106073

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:15:05.728Z. Updated 2026-10-23T16:15:05.728Z.

CVSS3.3v3.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 23:15 WIB

Official record

MedPublished 23 Oct 2026, 23:12 WIB

CVE-2026-115810

Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T16:12:12.359Z. Updated 2026-10-29T14:13:20.506Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 21:13 WIB

Official record

HighPublished 23 Oct 2026, 22:14 WIB

CVE-2026-57845

Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tabl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T15:14:20.497Z. Updated 2026-10-27T10:14:11.559Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

HighPublished 23 Oct 2026, 21:54 WIB

CVE-2026-54668

Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(Str…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:54:35.530Z. Updated 2026-10-29T14:11:07.235Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 21:11 WIB

Official record

HighPublished 23 Oct 2026, 21:49 WIB

CVE-2026-58497

Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:49:42.619Z. Updated 2026-10-23T20:57:14.612Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:57 WIB

Official record

MedPublished 23 Oct 2026, 21:45 WIB

CVE-2026-49442

Cacti: User Enumeration via Error Messages

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:45:13.062Z. Updated 2026-10-23T14:45:13.062Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:45 WIB

Official record

HighPublished 23 Oct 2026, 21:42 WIB

CVE-2026-39902

Cacti: Authenticated RCE on Data Input

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:42:45.710Z. Updated 2026-10-29T14:04:38.453Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 21:04 WIB

Official record

MedPublished 23 Oct 2026, 21:42 WIB

CVE-2026-46531

Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)

Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:42:27.937Z. Updated 2026-10-23T14:42:27.937Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:42 WIB

Official record

HighPublished 23 Oct 2026, 21:34 WIB

CVE-2026-102786

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:34:55.227Z. Updated 2026-10-25T13:27:13.059Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 20:27 WIB

Official record