Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 2001–2020 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 24 Mar 2026, 01:37 WIB

CVE-2026-4595

code-projects Exam Form Submission update_s6.php cross site scripting

A vulnerability was determined in code-projects Exam Form Submission 1.0. This vulnerability affects unknown code of the file /admin/update_s6.php. Executing a manipulation of the argument sname can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be uti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:37:03.375Z. Updated 2026-04-18T03:35:36.342Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 10:35 WIB

Official record

HighPublished 24 Mar 2026, 01:36 WIB

CVE-2025-15606

Denial of Service (DoS) in HTTPD Input Handling on TP-Link TD-W8961N

A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigger a processing error that causes the httpd service to crash. Successful exploitation may allow the attacker to cause service interruption, resulting in a DoS c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2001 to 2020 of 6236.First page Next page

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:36:15.648Z. Updated 2026-03-24T14:37:57.837Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:37 WIB

Official record

HighPublished 24 Mar 2026, 01:33 WIB

CVE-2026-25075

strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow

strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers can exploit the failure to validate AVP l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:33:10.952Z. Updated 2026-07-14T15:53:40.465Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record

HighPublished 24 Mar 2026, 01:28 WIB

CVE-2026-33650

AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion

WWBN AVideo is an open source video platform. In versions up to and including 26.0, a user with the "Videos Moderator" permission can escalate privileges to perform full video management operations — including ownership transfer and deletion of any video — despite the permission being documented as only allowing video …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:28:13.324Z. Updated 2026-03-24T14:10:38.572Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:10 WIB

Official record

HighPublished 24 Mar 2026, 01:26 WIB

CVE-2026-33649

AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets `session…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:26:32.866Z. Updated 2026-03-24T15:13:47.830Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:13 WIB

Official record

HighPublished 24 Mar 2026, 01:25 WIB

CVE-2026-33648

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-controlled `users_id` and `liveTransmitionHistory_id` values from the JSON request body without any sanitization. This log file path is then concatenated directly into…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:25:07.130Z. Updated 2026-03-25T14:28:05.154Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated25 Mar 2026, 21:28 WIB

Official record

HighPublished 24 Mar 2026, 01:23 WIB

CVE-2026-33647

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `ImageGallery::saveFile()` method validates uploaded file content using `finfo` MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. An attacker can upload…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:23:20.079Z. Updated 2026-03-24T17:36:15.421Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated25 Mar 2026, 00:36 WIB

Official record

HighPublished 24 Mar 2026, 01:21 WIB

CVE-2026-33513

AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:21:59.156Z. Updated 2026-03-24T14:27:53.769Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:27 WIB

Official record

HighPublished 24 Mar 2026, 01:17 WIB

CVE-2026-33512

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/me…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:17:47.070Z. Updated 2026-03-24T18:34:59.006Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated25 Mar 2026, 01:34 WIB

Official record

HighPublished 24 Mar 2026, 01:02 WIB

CVE-2025-15605

Hardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600

A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, modify them, and re-encrypt them, affecting the confidentiality and integrity of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:02:01.109Z. Updated 2026-03-24T03:56:03.860Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 10:56 WIB

Official record

HighPublished 24 Mar 2026, 01:01 WIB

CVE-2025-15519

Command Injection in Modem Management CLI on TP-Link Archer NX200, NX210, NX500 and NX600

Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:01:50.036Z. Updated 2026-03-24T03:56:00.901Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 10:56 WIB

Official record

HighPublished 24 Mar 2026, 01:01 WIB

CVE-2025-15518

Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600

Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:01:39.070Z. Updated 2026-03-24T03:55:59.756Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 10:55 WIB

Official record

HighPublished 24 Mar 2026, 01:01 WIB

CVE-2025-15517

Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T18:01:31.162Z. Updated 2026-03-24T03:56:05.005Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 10:56 WIB

Official record

MedPublished 24 Mar 2026, 00:41 WIB

CVE-2026-4594

erupts erupt EruptJpaUtils.java geneEruptHqlOrderBy sql injection

A vulnerability has been found in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy of the file erupt-data/erupt-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java. Such manipulation of the argument sort.field leads to sql injection hibernate. It is possible to launch the attack …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T17:41:26.211Z. Updated 2026-03-24T14:11:24.887Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:11 WIB

Official record

MedPublished 23 Mar 2026, 23:55 WIB

CVE-2026-4593

erupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injection

A flaw has been found in erupts erupt bis 1.13.3. Affected by this vulnerability is the function EruptDataQuery of the file erupt-ai/src/main/java/xyz/erupt/ai/call/impl/EruptDataQuery.java of the component MCP Tool Interface. This manipulation causes sql injection hibernate. It is possible to initiate the attack remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T16:55:59.020Z. Updated 2026-03-25T14:19:46.730Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Mar 2026, 21:19 WIB

Official record

HighPublished 23 Mar 2026, 23:32 WIB

CVE-2026-33507

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php` endpoint allows admin users to upload and install plugin ZIP files containing executable PHP code, but lacks any CSRF protection. Combined with the application explicitly setting `session.cookie_sames…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T16:32:28.925Z. Updated 2026-03-23T17:09:11.687Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 00:09 WIB

Official record

CritPublished 23 Mar 2026, 23:29 WIB

CVE-2026-33502

AVideo has Unauthenticated SSRF via plugin/Live/test.php

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, whe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T16:29:47.822Z. Updated 2026-03-24T15:13:52.835Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:13 WIB

Official record

MedPublished 23 Mar 2026, 23:28 WIB

CVE-2026-33501

AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.php` lacks any authentication or authorization check, allowing unauthenticated users to retrieve the complete permission matrix mapping user groups to plugins. All…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T16:28:20.513Z. Updated 2026-03-25T14:18:32.194Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated25 Mar 2026, 21:18 WIB

Official record

MedPublished 23 Mar 2026, 23:24 WIB

CVE-2026-33500

AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fix for CVE-2026-27568 (GHSA-rcqw-6466-3mv7) introduced a custom `ParsedownSafeWithLinks` class that sanitizes raw HTML `<a>` and `<img>` tags in comments, but explicitly disables Parsedown's `safeMode`. This creates a bypass: markd…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T16:24:52.892Z. Updated 2026-03-24T17:39:33.796Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated25 Mar 2026, 00:39 WIB

Official record

MedPublished 23 Mar 2026, 23:11 WIB

CVE-2026-33499

AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST['unlockPassword']` parameter directly into an HTML `<input>` tag's attributes without any output encoding or sanitization. An attacker can craft a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-23T16:11:57.528Z. Updated 2026-03-23T17:42:30.355Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated24 Mar 2026, 00:42 WIB

Official record