Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 2721–2740 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 15 Apr 2026, 06:26 WIB

CVE-2025-15470

Eleganzo <= 1.2 - Authenticated (Subscriber+) Arbitrary Directory Deletion

The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary direc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T23:26:06.733Z. Updated 2026-04-15T17:26:49.516Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 00:26 WIB

Official record

HighPublished 15 Apr 2026, 06:25 WIB

CVE-2026-39884

MCP Server Kubernetes has Argument Injection in its port_forward tool via space-splitting

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then naiv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2721 to 2740 of 5813.First page Next page

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T23:25:59.780Z. Updated 2026-04-15T16:13:59.605Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 23:13 WIB

Official record

CritPublished 15 Apr 2026, 06:21 WIB

CVE-2026-39842

OpenRemote is Vulnerable to Expression Injection

OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval() without sandboxing, class…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T23:21:22.242Z. Updated 2026-04-16T13:58:42.988Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 20:58 WIB

Official record

CritPublished 15 Apr 2026, 06:01 WIB

CVE-2026-39399

NuGet Gallery: Arbitrary Blob Overwrite via Nuspec Confusion and URI Fragment Truncation

NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file with malicious metadata, leading to cross package metadata injection that may result in remote code…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T23:01:38.176Z. Updated 2026-04-15T14:42:02.662Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 21:42 WIB

Official record

HighPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27297

Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191)

Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:20.265Z. Updated 2026-08-27T22:15:51.157Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

MedPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27300

Adobe Framemaker | Access of Uninitialized Pointer (CWE-824)

Adobe Framemaker versions 2022.8 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:18.661Z. Updated 2026-08-27T22:15:43.078Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27296

Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191)

Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:17.850Z. Updated 2026-08-27T22:15:54.739Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27290

Adobe Framemaker | Untrusted Search Path (CWE-426)

Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:17.003Z. Updated 2026-08-27T22:15:58.733Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27298

Adobe Framemaker | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)

Adobe Framemaker versions 2022.8 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:16.131Z. Updated 2026-08-27T22:15:53.988Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27294

Adobe Framemaker | Out-of-bounds Read (CWE-125)

Adobe Framemaker versions 2022.8 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:15.307Z. Updated 2026-08-27T22:15:50.414Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27295

Adobe Framemaker | Out-of-bounds Write (CWE-787)

Adobe Framemaker versions 2022.8 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:14.461Z. Updated 2026-08-27T22:15:48.237Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

MedPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27301

Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)

Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:13.588Z. Updated 2026-08-27T22:15:42.304Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

MedPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27299

Adobe Framemaker | Improper Input Validation (CWE-20)

Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the system. Exploitation of this issue requires user interaction in that a victim must…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:12.664Z. Updated 2026-08-27T22:15:51.512Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27293

Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)

Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:11.812Z. Updated 2026-08-27T22:15:46.775Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 05:58 WIB

CVE-2026-27292

Adobe Framemaker | Use After Free (CWE-416)

Adobe Framemaker versions 2022.8 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:58:10.867Z. Updated 2026-08-27T22:15:45.626Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 05:56 WIB

CVE-2026-39387

BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter

BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code Execution (RCE).The application fails to sanitize the tpl (te…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:56:20.935Z. Updated 2026-04-15T13:42:26.866Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 20:42 WIB

Official record

HighPublished 15 Apr 2026, 05:47 WIB

CVE-2026-35589

nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)

nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket server in bridge/src/server.ts, resulting from an incomplete remediation of CVE-2026-2577. The original fix changed the binding from 0.0.0.0 to 127.0.0.1 and added …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:47:32.837Z. Updated 2026-04-15T16:14:06.128Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 23:14 WIB

Official record

MedPublished 15 Apr 2026, 05:42 WIB

CVE-2026-33414

PowerShell Command Injection in Podman HyperV Machine

Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression inject…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:42:19.822Z. Updated 2026-07-15T01:06:27.842Z.

CVSS4v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:06 WIB

Official record

MedPublished 15 Apr 2026, 05:35 WIB

CVE-2026-40688

CVE-2026-40688

An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow a remote privileged attacker to execute arbitrary code or command via crafted HTTP requests.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:35:15.438Z. Updated 2026-04-16T03:55:18.342Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 10:55 WIB

Official record

MedPublished 15 Apr 2026, 05:31 WIB

CVE-2026-35034

Jellyfin: Potential Application DoS from excessively large SyncPlay group names

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By sending large payload…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:31:44.796Z. Updated 2026-04-15T17:48:39.733Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 00:48 WIB

Official record