Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 2721–2740 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 25 Aug 2026, 00:07 WIB

CVE-2026-71911

DrayTek VigorAP Multiple Models Buffer Overflow via setLan

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted input, causing a denial …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T17:07:44.256Z. Updated 2026-08-26T18:29:02.710Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:29 WIB

Official record

HighPublished 25 Aug 2026, 00:07 WIB

CVE-2026-71910

DrayTek VigorAP Multiple Models OS Command Injection via apautotest

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2721 to 2740 of 12259.First page Next page

Published 2026-08-24T17:07:43.597Z. Updated 2026-08-24T18:51:37.991Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 01:51 WIB

Official record

HighPublished 25 Aug 2026, 00:07 WIB

CVE-2026-71909

DrayTek VigorAP Multiple Models OS Command Injection via InquierTime

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T17:07:42.940Z. Updated 2026-08-24T19:53:01.368Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:53 WIB

Official record

HighPublished 25 Aug 2026, 00:07 WIB

CVE-2026-71908

DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T17:07:42.271Z. Updated 2026-08-26T16:14:57.367Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 23:14 WIB

Official record

HighPublished 25 Aug 2026, 00:07 WIB

CVE-2026-71907

DrayTek VigorAP Multiple Models OS Command Injection via setcamset

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T17:07:41.591Z. Updated 2026-08-24T19:02:15.607Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:02 WIB

Official record

HighPublished 25 Aug 2026, 00:07 WIB

CVE-2026-71906

DrayTek VigorAP Multiple Models OS Command Injection via setLan

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T17:07:40.927Z. Updated 2026-08-26T18:27:56.797Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:27 WIB

Official record

HighPublished 25 Aug 2026, 00:07 WIB

CVE-2026-71905

DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T17:07:40.253Z. Updated 2026-08-25T17:12:38.113Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:12 WIB

Official record

HighPublished 25 Aug 2026, 00:07 WIB

CVE-2026-71904

DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remote attacker can trigger this vulnerability via crafted input t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T17:07:39.592Z. Updated 2026-08-24T19:52:30.570Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:52 WIB

Official record

UnscoredPublished 24 Aug 2026, 23:42 WIB

CVE-2026-75099

Apache Allura: Unauthenticated REST disclosure

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1.20.0, which fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:42:20.920Z. Updated 2026-08-24T18:08:37.753Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 01:08 WIB

Official record

CritPublished 24 Aug 2026, 23:38 WIB

CVE-2025-36939

CVE-2025-36939

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:38:45.696Z. Updated 2026-08-24T17:20:14.187Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 00:20 WIB

Official record

UnscoredPublished 24 Aug 2026, 23:33 WIB

CVE-2025-36940

CVE-2025-36940

Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:33:53.675Z. Updated 2026-08-24T17:22:36.043Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 00:22 WIB

Official record

HighPublished 24 Aug 2026, 23:32 WIB

CVE-2026-15469

Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who obtains the firmware …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:32:12.573Z. Updated 2026-08-24T18:00:49.583Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 01:00 WIB

Official record

HighPublished 24 Aug 2026, 23:28 WIB

CVE-2026-78465

Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calcu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:28:12.574Z. Updated 2026-08-31T13:54:22.926Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 20:54 WIB

Official record

UnscoredPublished 24 Aug 2026, 23:22 WIB

CVE-2026-78329

Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed that instance into…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:22:17.528Z. Updated 2026-08-26T18:47:32.653Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:47 WIB

Official record

UnscoredPublished 24 Aug 2026, 23:21 WIB

CVE-2026-71300

Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is delivered to through…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:21:17.218Z. Updated 2026-08-25T19:39:50.077Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:39 WIB

Official record

UnscoredPublished 24 Aug 2026, 23:17 WIB

CVE-2026-63621

Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode the HTTP-header path …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:17:26.499Z. Updated 2026-08-25T19:39:09.091Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:39 WIB

Official record

UnscoredPublished 24 Aug 2026, 23:14 WIB

CVE-2026-66908

Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT keystore properties. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:14:18.202Z. Updated 2026-08-25T19:38:28.088Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:38 WIB

Official record

UnscoredPublished 24 Aug 2026, 23:13 WIB

CVE-2026-66907

Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when the downloadFileNam…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:13:04.957Z. Updated 2026-08-25T19:37:45.023Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:37 WIB

Official record

HighPublished 24 Aug 2026, 23:12 WIB

CVE-2026-19685

Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:12:38.297Z. Updated 2026-08-24T20:47:26.062Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 03:47 WIB

Official record

UnscoredPublished 24 Aug 2026, 23:12 WIB

CVE-2026-66906

Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its downloa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T16:12:09.993Z. Updated 2026-08-25T19:37:02.605Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:37 WIB

Official record