Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 2921–2940 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 19 Mar 2026, 04:40 WIB

CVE-2026-32878

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.20 and 8.6.44, an attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields by sending a crafted request that exploits prototype polluti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T21:40:34.828Z. Updated 2026-03-19T16:13:32.669Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 23:13 WIB

Official record

MedPublished 19 Mar 2026, 04:37 WIB

CVE-2026-32770

Parse Server: LiveQuery subscription with invalid regular expression crashes server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process terminates when the invalid pattern reache…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2921 to 2940 of 6236.First page Next page

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T21:37:36.470Z. Updated 2026-03-19T14:21:51.583Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 21:21 WIB

Official record

MedPublished 19 Mar 2026, 04:33 WIB

CVE-2026-32742

Parse Server session creation endpoint allows overwriting server-generated session fields

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields (`sessionToken`, `expiresAt`, `createdWith`) when creating a session object via `POST /classes/_Session`. This a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T21:33:09.421Z. Updated 2026-03-20T18:11:49.441Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated21 Mar 2026, 01:11 WIB

Official record

HighPublished 19 Mar 2026, 04:31 WIB

CVE-2026-32728

Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.15 and 8.6.41, an attacker who is allowed to upload files can bypass the file extension filter by appending a MIME parameter (e.g. `;charset=utf-8`) to the `Content-Type` header. This causes the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T21:31:08.506Z. Updated 2026-03-19T15:04:19.751Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 22:04 WIB

Official record

MedPublished 19 Mar 2026, 04:27 WIB

CVE-2026-32723

SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T21:27:35.349Z. Updated 2026-03-19T15:51:43.598Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 22:51 WIB

Official record

LowPublished 19 Mar 2026, 04:25 WIB

CVE-2026-32722

Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata

Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report. This allowed JavaS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T21:25:21.495Z. Updated 2026-03-19T17:39:50.970Z.

CVSS3.6v3.1KEVNot listedEPSSPresentUpdated20 Mar 2026, 00:39 WIB

Official record

CritPublished 19 Mar 2026, 04:04 WIB

CVE-2026-32703

OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy

OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not properly escape filenames displayed from repositories. This allowed an attacker with push access into the repository to create commits with filenames that includ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T21:04:16.982Z. Updated 2026-03-19T16:14:11.504Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 23:14 WIB

Official record

CritPublished 19 Mar 2026, 04:01 WIB

CVE-2026-32698

OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query without proper sanitat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T21:01:53.366Z. Updated 2026-03-19T14:22:17.046Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 21:22 WIB

Official record

MedPublished 19 Mar 2026, 03:55 WIB

CVE-2026-32700

Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to

Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email chan…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T20:55:55.034Z. Updated 2026-03-20T18:11:56.909Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated21 Mar 2026, 01:11 WIB

Official record

CritPublished 19 Mar 2026, 03:47 WIB

CVE-2026-25873

OmniGen2-RL Reward Server Unsafe Deserialization RCE

OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies to achieve code execution on the host sys…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T20:47:40.799Z. Updated 2026-07-28T01:48:23.137Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:48 WIB

Official record

LowPublished 19 Mar 2026, 03:41 WIB

CVE-2026-32638

StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts should be filtered from the result set. As a result, an admin token can request `rank=…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T20:41:14.034Z. Updated 2026-03-19T15:01:00.396Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 22:01 WIB

Official record

MedPublished 19 Mar 2026, 03:39 WIB

CVE-2026-32636

ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T20:39:44.447Z. Updated 2026-03-19T14:55:13.916Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 21:55 WIB

Official record

HighPublished 19 Mar 2026, 03:37 WIB

CVE-2026-32321

ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the `actions/ajax.php` endpoint. Due to insufficient input sanitization of the `userid` parameter, an authenticated attacker can execute arbitrary SQL quer…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T20:37:51.891Z. Updated 2026-03-19T17:47:53.606Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated20 Mar 2026, 00:47 WIB

Official record

MedPublished 19 Mar 2026, 03:34 WIB

CVE-2026-31973

NULL pointer dereference in samtools cram-size

SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T20:34:00.846Z. Updated 2026-03-19T16:14:59.386Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 23:14 WIB

Official record

MedPublished 19 Mar 2026, 03:32 WIB

CVE-2026-31972

samtools mpileup has use-after-free leading to an invalid read

SAMtools is a program for reading, manipulating and writing bioinformatics file formats. The `mpileup` command outputs DNA sequences that have been aligned against a known reference. On each output line it writes the reference position, optionally the reference DNA base at that position (obtained from a separate file) …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T20:32:29.862Z. Updated 2026-03-19T14:22:59.713Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 21:22 WIB

Official record

MedPublished 19 Mar 2026, 03:30 WIB

CVE-2026-25745

OpenEMR's Message Update Ignores Patient id

OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the message/note update endpoint (e.g. PUT or POST) updates by message/note ID only and does not verify that the message belongs to the current patient (or that the user is all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T20:30:30.642Z. Updated 2026-03-20T18:12:04.827Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Mar 2026, 01:12 WIB

Official record

HighPublished 19 Mar 2026, 02:55 WIB

CVE-2026-31971

HTSlib CRAM decoder vulnerable to buffer overflow

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the `BYTE_ARRAY_LEN` method, the `cram_byte_array_len_decode()` failed to validate that the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T19:55:20.379Z. Updated 2026-03-18T20:15:22.414Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:15 WIB

Official record

HighPublished 19 Mar 2026, 02:53 WIB

CVE-2026-31970

HTSlib BGZF index file reader has a heap buffer overflow

HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading function, `bgzf_index_load_hfile()`, it was possible to trigger an integer overflow, leading to an under- or zero-sized buffer being allocated to store the index. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T19:53:18.719Z. Updated 2026-03-18T23:08:18.668Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 06:08 WIB

Official record

HighPublished 19 Mar 2026, 02:47 WIB

CVE-2026-31969

HTSlib CRAM decoder has a heap buffer overflow

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the `BYTE_ARRAY_STOP` method, an out-by-one error in the `cram_byte_array_stop_decode_char(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T19:47:44.893Z. Updated 2026-03-18T20:12:53.495Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:12 WIB

Official record

UnscoredPublished 19 Mar 2026, 02:41 WIB

CVE-2026-4396

CVE-2026-4396

Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T19:41:34.801Z. Updated 2026-03-18T20:10:58.385Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:10 WIB

Official record