Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 2901–2920 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 24 Aug 2026, 07:30 WIB

CVE-2026-78160

Dolibarr ERP User Notes note.php authorization

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:30:10.986Z. Updated 2026-08-24T14:59:25.089Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 21:59 WIB

Official record

MedPublished 24 Aug 2026, 07:15 WIB

CVE-2026-78158

Open5GS AMF UEContextReleaseRequest Path improper authorization

A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2901 to 2920 of 12259.First page Next page

Published 2026-08-24T00:15:08.598Z. Updated 2026-08-27T14:37:40.371Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:37 WIB

Official record

MedPublished 24 Aug 2026, 07:00 WIB

CVE-2026-78157

Open5GS Rx AA-Request pcrf-rx-path.c pcrf_rx_aar_cb out-of-bounds

A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named c18dc6938bf63cc7374315d3dca303d9…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:13.451Z. Updated 2026-08-24T18:06:13.764Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 01:06 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2022-30983

CVE-2022-30983

A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HTML via the Enter email parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-27T19:09:20.010Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:09 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2025-26237

CVE-2025-26237

D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-28T18:11:53.381Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:11 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2025-26238

CVE-2025-26238

In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-28T18:10:43.239Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:10 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-30512

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlying Windows operating …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-25T19:46:32.079Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:46 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-52490

CVE-2026-52490

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-25T19:41:57.140Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:41 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-52492

CVE-2026-52492

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-27T19:05:00.091Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:05 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-56135

CVE-2026-56135

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-28T16:21:16.426Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 23:21 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-56136

CVE-2026-56136

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-28T16:20:11.948Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 23:20 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-71832

CVE-2026-71832

Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to cause a Denial of Service

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-28T16:23:44.540Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 23:23 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-75368

CVE-2026-75368

A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted ECSS TC message.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-28T15:01:13.914Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:01 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-75369

CVE-2026-75369

An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted CAN message.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-28T16:22:23.570Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 23:22 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-75370

CVE-2026-75370

An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted CAN message.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-25T19:45:17.679Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:45 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-75371

CVE-2026-75371

An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers with UART access to cause a Denial of Service (DoS) via a crafted input.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-25T19:44:01.570Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:44 WIB

Official record

UnscoredPublished 24 Aug 2026, 07:00 WIB

CVE-2026-75464

CVE-2026-75464

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-24T00:00:00.000Z. Updated 2026-08-25T19:43:03.503Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:43 WIB

Official record

MedPublished 24 Aug 2026, 06:45 WIB

CVE-2026-78156

Open5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflow

A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based buffer overflow. The attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-23T23:45:09.676Z. Updated 2026-08-26T18:08:53.935Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:08 WIB

Official record

MedPublished 24 Aug 2026, 06:15 WIB

CVE-2026-78148

ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference

A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pull request to fix thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-23T23:15:11.836Z. Updated 2026-08-24T17:49:30.355Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 00:49 WIB

Official record

MedPublished 24 Aug 2026, 06:00 WIB

CVE-2026-78147

ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization

A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-23T23:00:13.111Z. Updated 2026-08-27T14:37:49.255Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:37 WIB

Official record