Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 2741–2760 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

CritPublished 15 Apr 2026, 05:28 WIB

CVE-2026-35033

Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any lowercase query parameter t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:28:47.558Z. Updated 2026-04-15T13:36:26.787Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 Apr 2026, 20:36 WIB

Official record

HighPublished 15 Apr 2026, 05:25 WIB

CVE-2026-35032

Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP URLs. This is exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2741 to 2760 of 5813.First page Next page

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:25:35.729Z. Updated 2026-04-15T20:02:29.887Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated16 Apr 2026, 03:02 WIB

Official record

CritPublished 15 Apr 2026, 05:18 WIB

CVE-2026-35031

Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:18:30.565Z. Updated 2026-04-16T13:56:06.801Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 20:56 WIB

Official record

CritPublished 15 Apr 2026, 05:14 WIB

CVE-2026-34457

OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth_request-style integration (such as nginx auth_request) and either --ping-user-agent is set or --gcp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:14:38.937Z. Updated 2026-04-15T17:43:30.711Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 00:43 WIB

Official record

LowPublished 15 Apr 2026, 05:10 WIB

CVE-2026-34454

OAuth2 Proxy: Session cookie not cleared when rendering sign-in page

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be shown the sign-in page w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:10:37.901Z. Updated 2026-04-15T13:30:10.300Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 20:30 WIB

Official record

HighPublished 15 Apr 2026, 05:05 WIB

CVE-2026-33023

libsixel: Use-after-free in load_with_gdkpixbuf()

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. In versions 1.8.7 and prior, when built with the --with-gdk-pixbuf2 option, a use-after-free vulnerability exists in load_with_gdkpixbuf() in loader.c. The cleanup path manually frees the sixel_frame_t object and its internal buffers without…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T22:05:31.493Z. Updated 2026-04-15T20:02:36.839Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 03:02 WIB

Official record

HighPublished 15 Apr 2026, 04:57 WIB

CVE-2026-33021

libsixel: Use-after-free in sixel_encoder_encode_bytes()

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame->pixels without making a defensive copy. When a resize …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:57:22.817Z. Updated 2026-04-16T13:54:36.177Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 20:54 WIB

Official record

HighPublished 15 Apr 2026, 04:53 WIB

CVE-2026-34619

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:53:59.589Z. Updated 2026-08-27T22:15:57.643Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

LowPublished 15 Apr 2026, 04:53 WIB

CVE-2026-27308

ColdFusion | Uncontrolled Resource Consumption (CWE-400)

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:53:58.735Z. Updated 2026-08-27T22:15:53.632Z.

CVSS2.4v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 04:53 WIB

CVE-2026-27282

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:53:57.872Z. Updated 2026-08-27T22:15:54.359Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 04:53 WIB

CVE-2026-27305

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended acces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:53:57.015Z. Updated 2026-08-27T22:15:59.110Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

CritPublished 15 Apr 2026, 04:53 WIB

CVE-2026-27304

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:53:55.828Z. Updated 2026-08-27T22:15:47.879Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 04:53 WIB

CVE-2026-27306

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Attacker requires elevated privileges. Exploitation of this issue requires user interaction in that a victim must open a malicious …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:53:54.863Z. Updated 2026-08-27T22:15:57.996Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

LowPublished 15 Apr 2026, 04:53 WIB

CVE-2026-27307

ColdFusion | Uncontrolled Resource Consumption (CWE-400)

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:53:53.899Z. Updated 2026-08-27T22:15:51.876Z.

CVSS2.4v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:15 WIB

Official record

HighPublished 15 Apr 2026, 04:53 WIB

CVE-2026-33020

libsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel_frame_convert_to_rgb888() in frame.c, where allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) are per…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:53:00.388Z. Updated 2026-04-15T13:30:47.463Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 20:30 WIB

Official record

MedPublished 15 Apr 2026, 04:49 WIB

CVE-2026-34213

Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation

Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:49:55.380Z. Updated 2026-04-15T13:31:17.467Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 20:31 WIB

Official record

HighPublished 15 Apr 2026, 04:49 WIB

CVE-2026-33019

libsixel: Integer overflow leads to Out-of-bounds Read in img2sixel

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow leading to an out-of-bounds heap read in the --crop option handling of img2sixel, where positive coordinates up to INT_MAX are accepted without overflow-safe bounds checking. In sixel_enco…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:49:25.204Z. Updated 2026-04-15T20:02:46.628Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 03:02 WIB

Official record

HighPublished 15 Apr 2026, 04:45 WIB

CVE-2026-33018

libsixel: Use-After-Free in load_gif()

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a Use-After-Free vulnerability via the load_gif() function in fromgif.c, where a single sixel_frame_t object is reused across all frames of an animated GIF and gif_init_frame() unconditionally frees and reall…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:45:42.261Z. Updated 2026-04-16T13:53:25.060Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 20:53 WIB

Official record

MedPublished 15 Apr 2026, 04:42 WIB

CVE-2026-34212

Docmost page content has stored XSS via unsanitized attachment URLs

Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:42:44.202Z. Updated 2026-04-15T20:02:55.239Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 03:02 WIB

Official record

MedPublished 15 Apr 2026, 04:39 WIB

CVE-2026-33193

Docmost vulnerable to stored XSS via MIME type spoofing

Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the securi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T21:39:45.500Z. Updated 2026-04-16T13:51:42.724Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 20:51 WIB

Official record