Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 2861–2880 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 24 Aug 2026, 14:25 WIB

CVE-2026-78255

DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media

The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T07:25:24.159Z. Updated 2026-08-24T16:32:27.348Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 23:32 WIB

Official record

CritPublished 24 Aug 2026, 14:04 WIB

CVE-2026-78251

DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2861 to 2880 of 12259.First page Next page

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T07:04:32.474Z. Updated 2026-08-27T16:23:12.462Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:23 WIB

Official record

MedPublished 24 Aug 2026, 13:47 WIB

CVE-2026-8173

Information Disclosure via 'Copy learned MAC Addresses' Function

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T06:47:58.406Z. Updated 2026-08-27T16:46:11.517Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:46 WIB

Official record

MedPublished 24 Aug 2026, 13:15 WIB

CVE-2026-78202

itsourcecode Payroll System admin_class.php save_settings unrestricted upload

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T06:15:10.312Z. Updated 2026-08-24T17:56:15.815Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 00:56 WIB

Official record

MedPublished 24 Aug 2026, 13:00 WIB

CVE-2026-78201

itsourcecode Payroll System admin_class.php login sql injection

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T06:00:11.595Z. Updated 2026-08-26T18:19:41.926Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:19 WIB

Official record

MedPublished 24 Aug 2026, 12:45 WIB

CVE-2026-78200

itsourcecode Library Management System editbooks.php sql injection

A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T05:45:08.586Z. Updated 2026-08-24T16:34:17.862Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 23:34 WIB

Official record

MedPublished 24 Aug 2026, 12:30 WIB

CVE-2026-78199

SourceCodester Simple Online Food Ordering System view_prod.php sql injection

A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T05:30:09.950Z. Updated 2026-08-24T14:17:21.992Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 21:17 WIB

Official record

MedPublished 24 Aug 2026, 12:15 WIB

CVE-2026-78198

SourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injection

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Such manipulation of the argument pid leads to sql injection. The attack may be launched remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T05:15:09.154Z. Updated 2026-08-27T14:37:04.574Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:37 WIB

Official record

MedPublished 24 Aug 2026, 12:00 WIB

CVE-2026-78197

SourceCodester Simple Online Food Ordering System ajax.php save_user sql injection

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.php?action=save_user. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been made available to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T05:00:11.977Z. Updated 2026-08-24T17:56:52.179Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 00:56 WIB

Official record

HighPublished 24 Aug 2026, 11:50 WIB

CVE-2026-59561

CVE-2026-59561

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal".

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T04:50:58.663Z. Updated 2026-08-24T16:35:38.479Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 23:35 WIB

Official record

MedPublished 24 Aug 2026, 11:45 WIB

CVE-2026-78196

achorein expo-share-intent Android File Copy Routine ExpoShareIntentModule.kt getDataColumn path traversal

A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument _display_name results in path traversal. The attack requires a local approach. Upgradin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T04:45:10.579Z. Updated 2026-08-26T18:18:59.173Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:18 WIB

Official record

LowPublished 24 Aug 2026, 11:30 WIB

CVE-2026-78187

Piwigo Public Authentication cross site scripting

A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is said…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T04:30:08.597Z. Updated 2026-08-24T16:36:20.799Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 23:36 WIB

Official record

MedPublished 24 Aug 2026, 11:15 WIB

CVE-2026-78186

Open5GS HSS hss-cx-path.c assertion

A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the argument User-Name causes reachable assertion. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c9…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T04:15:08.586Z. Updated 2026-08-24T14:00:05.908Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 21:00 WIB

Official record

MedPublished 24 Aug 2026, 11:00 WIB

CVE-2026-78185

itsourcecode Sales and Inventory System cust_edit.php sql injection

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T04:00:08.931Z. Updated 2026-08-27T14:37:11.062Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:37 WIB

Official record

MedPublished 24 Aug 2026, 10:50 WIB

CVE-2026-78213

Hepta Platforms｜Heptabase - Stored Cross-Site Scripting

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T03:50:19.139Z. Updated 2026-08-24T16:37:30.848Z.

CVSS6.2v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 23:37 WIB

Official record

MedPublished 24 Aug 2026, 10:45 WIB

CVE-2026-78182

Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System plansImmediate PlanController.getImmediatePlans sql injection

A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the function PlanController.getImmediatePlans of the file /xbreport/api/v1/plamange/plansImmediate. The manipulation of the argument order/sort leads to s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T03:45:36.008Z. Updated 2026-08-24T17:57:33.067Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 00:57 WIB

Official record

HighPublished 24 Aug 2026, 10:36 WIB

CVE-2026-78212

4MOSAn Security Technology｜4MOSAn Management Center - Arbitrary File Read

4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T03:36:28.881Z. Updated 2026-08-24T16:38:10.832Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 23:38 WIB

Official record

MedPublished 24 Aug 2026, 10:35 WIB

CVE-2026-19852

CyberTutor｜NewSiteServer (NSS) - Arbitrary File Upload

NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T03:35:01.364Z. Updated 2026-08-24T16:49:20.971Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 23:49 WIB

Official record

CritPublished 24 Aug 2026, 10:32 WIB

CVE-2026-78211

4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection

4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby executing arbitrary system commands on the server.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T03:32:54.804Z. Updated 2026-08-24T12:51:11.649Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 19:51 WIB

Official record

MedPublished 24 Aug 2026, 10:30 WIB

CVE-2026-19853

CyberTutor｜NewSiteServer (NSS) - Missing Authentication

NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emails to anyone on behalf of the school.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T03:30:35.116Z. Updated 2026-08-24T12:51:11.807Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 19:51 WIB

Official record