Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,616 published records · 20 KEV · 4,616 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,616 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3317.2%
High1,42031%
Med1,98843%
Low2104.5%
None360.78%
Legacy00.00%
Unscored63114%

Matching records by UTC month

Feb 264,616

Signal coverage

KEV-listed: 20
With a forecast: 4,616
Unknown date: 0
Unscored severity: 631

Share of cohort: KEV 0.43% · forecast 100% · unscored 14%.

Showing 201–220 of 4,616By severity band: Critical · 9.0–10.0 331, High · 7.0–8.9 1,420, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 210, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 631

HighPublished 27 Feb 2026, 06:59 WIB

CVE-2026-25113

SWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:59:46.758Z. Updated 2026-03-10T19:20:52.878Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated11 Mar 2026, 02:20 WIB

Official record

CritPublished 27 Feb 2026, 06:57 WIB

CVE-2026-27767

SWITCH EV swtchenergy.com Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive O…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 201 to 220 of 4616.First page Next page

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:57:51.070Z. Updated 2026-03-05T20:43:40.109Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:43 WIB

Official record

MedPublished 27 Feb 2026, 06:50 WIB

CVE-2026-22890

EV2GO ev2go.io Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:50:56.274Z. Updated 2026-03-05T20:13:55.698Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:13 WIB

Official record

MedPublished 27 Feb 2026, 06:48 WIB

CVE-2026-20895

EV2GO ev2go.io Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:48:03.827Z. Updated 2026-03-05T20:10:55.114Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:10 WIB

Official record

HighPublished 27 Feb 2026, 06:46 WIB

CVE-2026-25945

EV2GO ev2go.io Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:46:14.876Z. Updated 2026-03-31T14:20:00.190Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:20 WIB

Official record

CritPublished 27 Feb 2026, 06:43 WIB

CVE-2026-24731

EV2GO ev2go.io Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive O…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:43:51.003Z. Updated 2026-03-05T20:16:11.799Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:16 WIB

Official record

HighPublished 27 Feb 2026, 06:39 WIB

CVE-2026-1585

CVE-2026-1585

An unquoted Windows service executable path vulnerability in IJ Scan Utility for Windows versions 1.1.2 through 1.5.0 may allow a local attacker to execute a malicious file with the privileges of the affected service.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:39:13.778Z. Updated 2026-03-03T01:11:36.228Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated03 Mar 2026, 08:11 WIB

Official record

MedPublished 27 Feb 2026, 06:38 WIB

CVE-2026-20733

CloudCharge cloudcharge.se Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:38:02.525Z. Updated 2026-03-31T14:18:24.613Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:18 WIB

Official record

MedPublished 27 Feb 2026, 06:36 WIB

CVE-2026-27652

CloudCharge cloudcharge.se Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:36:33.131Z. Updated 2026-03-31T14:18:01.596Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:18 WIB

Official record

UnscoredPublished 27 Feb 2026, 06:33 WIB

CVE-2025-40932

Apache::SessionX versions through 2.01 for Perl create insecure session id

Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:33:37.083Z. Updated 2026-02-27T18:41:24.407Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:41 WIB

Official record

MedPublished 27 Feb 2026, 06:32 WIB

CVE-2026-3270

psi-probe PSI Probe Whois Whois.java lookup server-side request forgery

A vulnerability has been found in psi-probe PSI Probe up to 5.3.0. This affects the function lookup of the file psi-probe-core/src/main/java/psiprobe/tools/Whois.java of the component Whois. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:32:09.687Z. Updated 2026-02-27T19:55:03.743Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 02:55 WIB

Official record

MedPublished 27 Feb 2026, 06:32 WIB

CVE-2026-3269

psi-probe PSI Probe Session ExpireSessionsController.java handleRequestInternal denial of service

A flaw has been found in psi-probe PSI Probe up to 5.3.0. The impacted element is the function handleRequestInternal of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/ExpireSessionsController.java of the component Session Handler. Executing a manipulation can lead to denial of service. The attack c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:32:07.430Z. Updated 2026-02-27T19:57:57.822Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 02:57 WIB

Official record

UnscoredPublished 27 Feb 2026, 06:29 WIB

CVE-2026-2597

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes()

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes(). The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zer…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:29:16.488Z. Updated 2026-02-27T18:50:46.353Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:50 WIB

Official record

HighPublished 27 Feb 2026, 06:27 WIB

CVE-2026-25114

CloudCharge cloudcharge.se Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:27:18.456Z. Updated 2026-03-05T20:18:16.637Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:18 WIB

Official record

CritPublished 27 Feb 2026, 06:24 WIB

CVE-2026-20781

CloudCharge cloudcharge.se Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive O…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:24:00.964Z. Updated 2026-03-05T19:40:05.284Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 02:40 WIB

Official record

MedPublished 27 Feb 2026, 06:10 WIB

CVE-2026-20791

Chargemap chargemap.com Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:10:16.841Z. Updated 2026-03-05T19:41:21.033Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 02:41 WIB

Official record

MedPublished 27 Feb 2026, 06:08 WIB

CVE-2026-25711

Chargemap chargemap.com Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:08:22.088Z. Updated 2026-03-05T20:19:35.596Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:19 WIB

Official record

HighPublished 27 Feb 2026, 06:06 WIB

CVE-2026-20792

Chargemap chargemap.com Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or misrouting legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:06:29.969Z. Updated 2026-03-05T19:42:31.634Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 02:42 WIB

Official record

CritPublished 27 Feb 2026, 06:04 WIB

CVE-2026-25851

Chargemap chargemap.com Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive O…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:04:13.166Z. Updated 2026-03-05T20:34:08.453Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Mar 2026, 03:34 WIB

Official record

MedPublished 27 Feb 2026, 06:02 WIB

CVE-2026-3268

psi-probe PSI Probe Session Attribute RemoveSessAttributeController.java access control

A vulnerability was detected in psi-probe PSI Probe up to 5.3.0. The affected element is an unknown function of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/RemoveSessAttributeController.java of the component Session Attribute Handler. Performing a manipulation results in improper access controls…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:02:08.067Z. Updated 2026-02-27T17:27:38.521Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:27 WIB

Official record