Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2701–2720 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 23 Oct 2026, 21:31 WIB

CVE-2026-55222

Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user (the one that executes Isar) instead of root. If the calling user's i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:31:41.863Z. Updated 2026-10-23T20:57:39.282Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:57 WIB

Official record

CritPublished 23 Oct 2026, 21:25 WIB

CVE-2026-53942

Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN

Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2701 to 2720 of 16156.First page Next page

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:25:00.085Z. Updated 2026-10-23T14:57:32.991Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:57 WIB

Official record

CritPublished 23 Oct 2026, 21:17 WIB

CVE-2026-55486

Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:17:42.732Z. Updated 2026-10-23T14:17:42.732Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:17 WIB

Official record

MedPublished 23 Oct 2026, 21:17 WIB

CVE-2026-55465

Goobi viewer: Solr injection via unvalidated region parameter in spatial search

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied region query parameter directly into a Solr query string with n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:17:27.529Z. Updated 2026-10-23T14:17:27.529Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:17 WIB

Official record

MedPublished 23 Oct 2026, 21:17 WIB

CVE-2026-55463

Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:17:06.825Z. Updated 2026-10-29T13:59:55.819Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:59 WIB

Official record

MedPublished 23 Oct 2026, 21:16 WIB

CVE-2026-112333

GFI Archiver < 15.14 Stored XSS via MailInsights.aspx

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.bt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:16:48.726Z. Updated 2026-10-23T14:16:48.726Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:16 WIB

Official record

HighPublished 23 Oct 2026, 21:16 WIB

CVE-2026-55459

Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic val…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:16:44.995Z. Updated 2026-10-23T14:57:39.675Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:57 WIB

Official record

HighPublished 23 Oct 2026, 21:16 WIB

CVE-2026-55457

Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first check…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:16:27.063Z. Updated 2026-10-23T14:16:27.063Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:16 WIB

Official record

MedPublished 23 Oct 2026, 21:16 WIB

CVE-2026-55444

Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:16:16.350Z. Updated 2026-10-23T14:16:16.350Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:16 WIB

Official record

CritPublished 23 Oct 2026, 21:15 WIB

CVE-2026-46652

Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:15:46.415Z. Updated 2026-10-23T14:15:46.415Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:15 WIB

Official record

CritPublished 23 Oct 2026, 21:15 WIB

CVE-2026-46651

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:15:28.088Z. Updated 2026-10-23T14:15:28.088Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:15 WIB

Official record

MedPublished 23 Oct 2026, 21:14 WIB

CVE-2026-46347

Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:14:51.802Z. Updated 2026-10-29T13:57:32.624Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:57 WIB

Official record

MedPublished 23 Oct 2026, 21:14 WIB

CVE-2026-46346

Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:14:39.197Z. Updated 2026-10-23T20:58:03.501Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:58 WIB

Official record

MedPublished 23 Oct 2026, 21:14 WIB

CVE-2026-55442

Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:14:26.455Z. Updated 2026-10-29T13:56:19.871Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:56 WIB

Official record

HighPublished 23 Oct 2026, 21:06 WIB

CVE-2026-115478

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/<type>/<name>.md` path without reliably preserving note …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:06:28.128Z. Updated 2026-10-23T14:06:28.128Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:06 WIB

Official record

HighPublished 23 Oct 2026, 21:04 WIB

CVE-2026-115477

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a dispatch-gated tool call offered an `inputRequired` confirmation could …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:04:33.518Z. Updated 2026-10-23T14:04:33.518Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:04 WIB

Official record

HighPublished 23 Oct 2026, 21:00 WIB

CVE-2026-115457

baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T14:00:33.254Z. Updated 2026-10-29T13:55:12.435Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:55 WIB

Official record

MedPublished 23 Oct 2026, 20:53 WIB

CVE-2026-115786

Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion

A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:53:33.918Z. Updated 2026-10-28T19:48:38.750Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:48 WIB

Official record

MedPublished 23 Oct 2026, 20:50 WIB

CVE-2026-115785

Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:50:33.115Z. Updated 2026-10-29T10:45:48.181Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

HighPublished 23 Oct 2026, 20:47 WIB

CVE-2026-114624

baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API resp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:47:08.832Z. Updated 2026-10-29T13:37:07.749Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:37 WIB

Official record