Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 201–220 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

CritPublished 31 Mar 2026, 15:51 WIB

CVE-2026-3106

Multiple vulnerabilities in Teampass

Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the login form 'redacted/index.php'. During failed authentication attempts, the application does not properly clean or encode the information entered by the user in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T08:51:35.333Z. Updated 2026-03-31T18:04:26.550Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:04 WIB

Official record

MedPublished 31 Mar 2026, 15:48 WIB

CVE-2025-41355

Reflected Cross-Site Scripting on Anon Proxy Server

Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform action…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 201 to 220 of 6236.First page Next page

Published 2026-03-31T08:48:28.950Z. Updated 2026-03-31T18:04:32.025Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:04 WIB

Official record

HighPublished 31 Mar 2026, 15:41 WIB

CVE-2025-10559

Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x

A Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to read or write files in specific directories on the server.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T08:41:43.180Z. Updated 2026-03-31T18:04:37.440Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:04 WIB

Official record

HighPublished 31 Mar 2026, 15:41 WIB

CVE-2025-10553

Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x

A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T08:41:35.663Z. Updated 2026-03-31T13:32:40.143Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 20:32 WIB

Official record

HighPublished 31 Mar 2026, 15:38 WIB

CVE-2025-10551

Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x

A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T08:38:33.576Z. Updated 2026-03-31T13:45:07.096Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 20:45 WIB

Official record

HighPublished 31 Mar 2026, 15:32 WIB

CVE-2026-5201

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail gene…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T08:32:58.344Z. Updated 2026-07-15T00:46:21.895Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 07:46 WIB

Official record

MedPublished 31 Mar 2026, 15:15 WIB

CVE-2026-5195

code-projects Student Membership System User Registration sql injection

A flaw has been found in code-projects Student Membership System 1.0. This issue affects some unknown processing of the component User Registration Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T08:15:13.647Z. Updated 2026-03-31T12:45:21.409Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 19:45 WIB

Official record

MedPublished 31 Mar 2026, 14:30 WIB

CVE-2026-5186

Nothings stb Multi-frame GIF File stb_image.h stbi__load_gif_main double free

A weakness has been identified in Nothings stb up to 2.30. This impacts the function stbi__load_gif_main of the file stb_image.h of the component Multi-frame GIF File Handler. This manipulation causes double free. The attack requires local access. The exploit has been made available to the public and could be used for …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T07:30:11.484Z. Updated 2026-03-31T15:36:58.990Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 22:36 WIB

Official record

MedPublished 31 Mar 2026, 13:45 WIB

CVE-2026-5185

Nothings stb_image Multi-frame GIF File stb_image.h stbi__gif_load_next heap-based overflow

A security flaw has been discovered in Nothings stb_image up to 2.30. This affects the function stbi__gif_load_next of the file stb_image.h of the component Multi-frame GIF File Handler. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T06:45:24.723Z. Updated 2026-03-31T18:04:42.847Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:04 WIB

Official record

MedPublished 31 Mar 2026, 13:45 WIB

CVE-2026-5184

TRENDnet TEW-713RE setSysAdm command injection

A vulnerability was identified in TRENDnet TEW-713RE up to 1.02. The impacted element is an unknown function of the file /goform/setSysAdm. The manipulation of the argument admuser leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was conta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T06:45:22.567Z. Updated 2026-03-31T13:46:36.074Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 20:46 WIB

Official record

UnscoredPublished 31 Mar 2026, 13:00 WIB

CVE-2026-3881

Performance Monitor <= 1.0.6 - Unauthenticated Blind SSRF

The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attacks

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T06:00:06.964Z. Updated 2026-04-02T12:39:58.231Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2026, 19:39 WIB

Official record

MedPublished 31 Mar 2026, 12:45 WIB

CVE-2026-5183

TRENDnet TEW-713RE addRouting sub_421494 command injection

A vulnerability was determined in TRENDnet TEW-713RE up to 1.02. The affected element is the function sub_421494 of the file /goform/addRouting. Executing a manipulation of the argument dest can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T05:45:17.383Z. Updated 2026-04-02T14:59:28.115Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 21:59 WIB

Official record

MedPublished 31 Mar 2026, 12:45 WIB

CVE-2026-5182

SourceCodester Teacher Record System Parameter sql injection

A vulnerability was found in SourceCodester Teacher Record System 1.0. Impacted is an unknown function of the file Teacher Record System of the component Parameter Handler. Performing a manipulation of the argument searchteacher results in sql injection. It is possible to initiate the attack remotely. The exploit has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T05:45:14.695Z. Updated 2026-03-31T12:57:52.304Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 19:57 WIB

Official record

MedPublished 31 Mar 2026, 12:29 WIB

CVE-2026-34881

CVE-2026-34881

OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and gl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T05:29:08.449Z. Updated 2026-08-14T12:04:37.797Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated14 Aug 2026, 19:04 WIB

Official record

MedPublished 31 Mar 2026, 12:28 WIB

CVE-2026-1877

Auto Post Scheduler <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page

The Auto Post Scheduler plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.84. This is due to missing nonce validation on the 'aps_options_page' function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T05:28:52.635Z. Updated 2026-04-08T17:18:54.457Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:18 WIB

Official record

MedPublished 31 Mar 2026, 12:28 WIB

CVE-2026-1834

Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ive' shortcode in all versions up to, and including, 1.2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T05:28:51.970Z. Updated 2026-04-08T17:17:28.829Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:17 WIB

Official record

MedPublished 31 Mar 2026, 11:45 WIB

CVE-2026-5181

SourceCodester Simple Doctors Appointment System ajax.php unrestricted upload

A vulnerability has been found in SourceCodester Simple Doctors Appointment System up to 1.0. This issue affects some unknown processing of the file /doctors_appointment/admin/ajax.php?action=save_category. Such manipulation of the argument img leads to unrestricted upload. The attack may be performed from remote. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T04:45:12.249Z. Updated 2026-03-31T15:36:15.911Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 22:36 WIB

Official record

MedPublished 31 Mar 2026, 11:25 WIB

CVE-2026-4146

Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter

The Loco Translate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘update_href’ parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T04:25:32.829Z. Updated 2026-04-08T17:34:25.107Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:34 WIB

Official record

MedPublished 31 Mar 2026, 11:25 WIB

CVE-2026-1710

WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_upe_appearance_ajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to update plugin settin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T04:25:32.434Z. Updated 2026-05-12T16:56:37.124Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 23:56 WIB

Official record

MedPublished 31 Mar 2026, 11:25 WIB

CVE-2026-1797

Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files

The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed view…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T04:25:31.834Z. Updated 2026-04-08T16:51:51.528Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:51 WIB

Official record