Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 2881–2900 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 19 Mar 2026, 08:00 WIB

CVE-2026-31994

OpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generation

OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and expansion-sensitive characters in gateway.cmd files. Local attackers with control over service script generation arguments can inject arbitrar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:52.737Z. Updated 2026-06-23T16:14:22.640Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

MedPublished 19 Mar 2026, 08:00 WIB

CVE-2026-31993

OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains

OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist vali…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2881 to 2900 of 6236.First page Next page

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:51.999Z. Updated 2026-06-23T16:14:21.935Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

HighPublished 19 Mar 2026, 08:00 WIB

CVE-2026-31992

OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:51.216Z. Updated 2026-06-23T16:14:21.247Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

LowPublished 19 Mar 2026, 08:00 WIB

CVE-2026-31991

OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthoriz…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:50.508Z. Updated 2026-06-23T16:14:20.570Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

MedPublished 19 Mar 2026, 08:00 WIB

CVE-2026-31990

OpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:49.811Z. Updated 2026-06-23T16:14:19.884Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

MedPublished 19 Mar 2026, 08:00 WIB

CVE-2026-31989

OpenClaw < 2026.3.1 - Server-Side Request Forgery via web_search Citation Redirect

OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy. An attacker who can influence citation redirect targets can trigger internal-network requests from the OpenClaw host to loopback, private, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:49.055Z. Updated 2026-06-23T16:14:19.200Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

MedPublished 19 Mar 2026, 08:00 WIB

CVE-2026-29608

OpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting

OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:48.321Z. Updated 2026-06-23T16:14:18.525Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

HighPublished 19 Mar 2026, 08:00 WIB

CVE-2026-29607

OpenClaw < 2026.2.22 - Authorization Bypass via allow-always Wrapper Persistence

OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval checks by persisting wrapper-level allowlist entries instead of validating inner executable intent. Remote attackers can approve benign wrapped system.run comma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:47.572Z. Updated 2026-06-23T16:14:17.843Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

HighPublished 19 Mar 2026, 08:00 WIB

CVE-2026-28461

OpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn

OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different query parameters to cause …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:46.834Z. Updated 2026-06-23T16:14:13.747Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

MedPublished 19 Mar 2026, 08:00 WIB

CVE-2026-28460

OpenClaw < 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution in system.run

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by splitting command substitution using shell line-continuation characters. Attackers can bypass security analysis by injecting $\\ followed by a newline and opening par…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:46.135Z. Updated 2026-06-23T16:14:13.053Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

MedPublished 19 Mar 2026, 08:00 WIB

CVE-2026-28449

OpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression

OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound message processing and cause integrity or av…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:45.387Z. Updated 2026-06-23T16:14:12.343Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

MedPublished 19 Mar 2026, 08:00 WIB

CVE-2026-27670

OpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition

OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race between path validation and file write operations by rebinding parent directory symli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:44.620Z. Updated 2026-06-23T16:14:11.655Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

HighPublished 19 Mar 2026, 08:00 WIB

CVE-2026-27566

OpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads that satisfy allowlist entries while executing non-allowlisted c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:43.726Z. Updated 2026-06-23T16:14:10.318Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:14 WIB

Official record

MedPublished 19 Mar 2026, 08:00 WIB

CVE-2026-22176

OpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script Generation

OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary com…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T01:00:42.893Z. Updated 2026-06-23T16:13:49.077Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:13 WIB

Official record

UnscoredPublished 19 Mar 2026, 07:00 WIB

CVE-2025-67112

CVE-2025-67112

Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote authenticated users to decrypt, modify, and re-encrypt device configurations, enabling credential manipulation and privilege escal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T00:00:00.000Z. Updated 2026-03-24T01:17:45.000Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2026, 08:17 WIB

Official record

UnscoredPublished 19 Mar 2026, 07:00 WIB

CVE-2025-67113

CVE-2025-67113

OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into the firmware upgrade…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T00:00:00.000Z. Updated 2026-03-24T01:20:45.931Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2026, 08:20 WIB

Official record

UnscoredPublished 19 Mar 2026, 07:00 WIB

CVE-2025-67114

CVE-2025-67114

Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers to derive valid administrative/root credentials from the device's MAC address, enabling authentication bypass and full device access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T00:00:00.000Z. Updated 2026-03-24T01:23:37.027Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2026, 08:23 WIB

Official record

UnscoredPublished 19 Mar 2026, 07:00 WIB

CVE-2025-67115

CVE-2025-67115

A path traversal vulnerability in /ftl/web/setup.cgi in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote authenticated users to read arbitrary files from the filesystem via crafted values in the log_type parameter to /logsave.htm.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T00:00:00.000Z. Updated 2026-03-24T01:26:02.991Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2026, 08:26 WIB

Official record

HighPublished 19 Mar 2026, 07:00 WIB

CVE-2025-69720

CVE-2025-69720

The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T00:00:00.000Z. Updated 2026-06-02T13:00:33.095Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 20:00 WIB

Official record

UnscoredPublished 19 Mar 2026, 07:00 WIB

CVE-2026-25667

CVE-2026-25667

ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-19T00:00:00.000Z. Updated 2026-04-29T14:34:11.558Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Apr 2026, 21:34 WIB

Official record