Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2741–2760 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 23 Oct 2026, 20:26 WIB

CVE-2026-93634

Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records

A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:26:11.070Z. Updated 2026-10-28T19:50:45.601Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:50 WIB

Official record

MedPublished 23 Oct 2026, 20:25 WIB

CVE-2026-93633

Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters

A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2741 to 2760 of 16156.First page Next page

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:25:21.365Z. Updated 2026-10-28T19:51:07.972Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:51 WIB

Official record

HighPublished 23 Oct 2026, 20:23 WIB

CVE-2026-93631

Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and inst…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:23:34.952Z. Updated 2026-10-28T19:51:18.814Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:51 WIB

Official record

MedPublished 23 Oct 2026, 20:21 WIB

CVE-2026-93630

Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:21:39.551Z. Updated 2026-10-28T19:51:28.013Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:51 WIB

Official record

MedPublished 23 Oct 2026, 20:21 WIB

CVE-2026-55606

odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:21:21.038Z. Updated 2026-10-23T13:21:21.038Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 20:21 WIB

Official record

HighPublished 23 Oct 2026, 20:21 WIB

CVE-2026-53918

odhcpd DHCPv6 IA dangling first pointer use-after-free

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:21:00.665Z. Updated 2026-10-23T13:21:00.665Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 20:21 WIB

Official record

HighPublished 23 Oct 2026, 20:20 WIB

CVE-2026-53920

odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving tha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:20:48.045Z. Updated 2026-10-23T20:58:10.536Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 03:58 WIB

Official record

LowPublished 23 Oct 2026, 20:20 WIB

CVE-2026-115754

serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:20:43.932Z. Updated 2026-10-23T14:58:11.402Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:58 WIB

Official record

CritPublished 23 Oct 2026, 20:20 WIB

CVE-2026-53921

odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:20:30.249Z. Updated 2026-10-29T13:28:11.455Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:28 WIB

Official record

MedPublished 23 Oct 2026, 20:19 WIB

CVE-2026-93629

Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity

An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER id…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:19:26.405Z. Updated 2026-10-28T19:51:47.292Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:51 WIB

Official record

MedPublished 23 Oct 2026, 20:18 WIB

CVE-2026-93628

Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:18:16.368Z. Updated 2026-10-28T20:02:01.885Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:02 WIB

Official record

MedPublished 23 Oct 2026, 20:17 WIB

CVE-2026-93627

Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:17:00.739Z. Updated 2026-10-28T20:02:13.577Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:02 WIB

Official record

HighPublished 23 Oct 2026, 20:15 WIB

CVE-2026-50053

Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters

A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the reque…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:15:44.976Z. Updated 2026-10-28T20:02:22.353Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:02 WIB

Official record

HighPublished 23 Oct 2026, 20:14 WIB

CVE-2026-10632

Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-5…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:14:04.118Z. Updated 2026-10-28T20:02:30.433Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:02 WIB

Official record

LowPublished 23 Oct 2026, 20:03 WIB

CVE-2026-115752

Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:03:34.217Z. Updated 2026-10-29T13:25:03.492Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:25 WIB

Official record

MedPublished 23 Oct 2026, 20:03 WIB

CVE-2026-115751

mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:03:33.492Z. Updated 2026-10-23T13:03:33.492Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 20:03 WIB

Official record

MedPublished 23 Oct 2026, 20:03 WIB

CVE-2026-115750

mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:03:32.783Z. Updated 2026-10-23T13:03:32.783Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 20:03 WIB

Official record

MedPublished 23 Oct 2026, 20:03 WIB

CVE-2026-115749

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:03:32.068Z. Updated 2026-10-23T14:58:26.781Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:58 WIB

Official record

CritPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112848

WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:00:20.030Z. Updated 2026-10-24T14:46:59.432Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:46 WIB

Official record

HighPublished 23 Oct 2026, 20:00 WIB

CVE-2026-112849

WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T13:00:19.660Z. Updated 2026-10-23T14:58:45.182Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:58 WIB

Official record