Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2721–2740 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 23 Oct 2026, 20:45 WIB

CVE-2026-114623

baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:45:29.675Z. Updated 2026-10-23T14:57:47.887Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:57 WIB

Official record

HighPublished 23 Oct 2026, 20:41 WIB

CVE-2026-114622

baserCMS: Encoded path traversal bypass in the theme file API

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because nor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2721 to 2740 of 16156.First page Next page

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:41:33.272Z. Updated 2026-10-23T13:41:33.272Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 20:41 WIB

Official record

MedPublished 23 Oct 2026, 20:40 WIB

CVE-2026-57207

NetBox MCP Server: HTTP transport exposes all NetBox data without authentication

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or creden…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:40:31.164Z. Updated 2026-10-23T13:40:31.164Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 20:40 WIB

Official record

HighPublished 23 Oct 2026, 20:39 WIB

CVE-2026-114621

baserCMS: SQL injection in the admin panel and admin API

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:39:42.762Z. Updated 2026-10-23T13:39:42.762Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 20:39 WIB

Official record

CritPublished 23 Oct 2026, 20:39 WIB

CVE-2026-114357

DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)

Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authoriza…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:39:28.510Z. Updated 2026-10-28T19:48:46.412Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:48 WIB

Official record

MedPublished 23 Oct 2026, 20:37 WIB

CVE-2026-57208

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind

Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata that causes entire session resume or entire checkpoint rewind to write attacker-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:37:40.983Z. Updated 2026-10-23T14:57:55.652Z.

CVSS6.2v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:57 WIB

Official record

HighPublished 23 Oct 2026, 20:37 WIB

CVE-2026-114356

DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone ch…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:37:34.059Z. Updated 2026-10-28T19:48:55.339Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:48 WIB

Official record

MedPublished 23 Oct 2026, 20:37 WIB

CVE-2026-115480

baserCMS: Public Web API mail-form submission bypasses image CAPTCHA

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_captcha setting. BcMail\Controller\Api\MailMessagesController::add() and MailMessag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:37:32.184Z. Updated 2026-10-23T13:37:32.184Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 20:37 WIB

Official record

MedPublished 23 Oct 2026, 20:36 WIB

CVE-2026-115479

baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients

baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:36:01.655Z. Updated 2026-10-23T13:36:01.655Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 20:36 WIB

Official record

HighPublished 23 Oct 2026, 20:35 WIB

CVE-2026-114355

DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root

OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:35:42.796Z. Updated 2026-10-28T19:49:04.451Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:49 WIB

Official record

HighPublished 23 Oct 2026, 20:34 WIB

CVE-2026-93640

Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the confi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:34:41.851Z. Updated 2026-10-24T03:55:19.407Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 10:55 WIB

Official record

HighPublished 23 Oct 2026, 20:34 WIB

CVE-2026-115481

baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:34:26.038Z. Updated 2026-10-23T14:58:03.802Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:58 WIB

Official record

HighPublished 23 Oct 2026, 20:33 WIB

CVE-2026-114354

DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root

Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:33:36.131Z. Updated 2026-10-28T19:49:13.764Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:49 WIB

Official record

HighPublished 23 Oct 2026, 20:33 WIB

CVE-2026-50057

Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions

A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can selec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:33:29.682Z. Updated 2026-10-29T10:45:48.334Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

HighPublished 23 Oct 2026, 20:31 WIB

CVE-2026-114353

DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:31:05.598Z. Updated 2026-10-28T19:49:26.784Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:49 WIB

Official record

HighPublished 23 Oct 2026, 20:30 WIB

CVE-2026-50056

Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection

A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:30:43.654Z. Updated 2026-10-29T10:45:48.481Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

HighPublished 23 Oct 2026, 20:29 WIB

CVE-2026-93639

Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:29:25.939Z. Updated 2026-10-28T19:49:41.321Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:49 WIB

Official record

MedPublished 23 Oct 2026, 20:28 WIB

CVE-2026-93638

Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:28:03.891Z. Updated 2026-10-28T19:49:53.291Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:49 WIB

Official record

HighPublished 23 Oct 2026, 20:27 WIB

CVE-2026-55826

Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:27:45.250Z. Updated 2026-10-29T13:32:21.226Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:32 WIB

Official record

MedPublished 23 Oct 2026, 20:27 WIB

CVE-2026-93636

Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name

An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP filter expressions witho…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:27:14.020Z. Updated 2026-10-28T19:50:14.434Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:50 WIB

Official record