Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 2021–2040 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 26 Sep 2026, 01:29 WIB

CVE-2026-55217

GLPI: Unallowed modfication of knowbase items comments and translations

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:29:28.418Z. Updated 2026-09-25T19:05:01.467Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:05 WIB

Official record

MedPublished 26 Sep 2026, 01:28 WIB

CVE-2026-53628

GLPI: Unallowed authentication method update by administrator

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The aff…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2021 to 2040 of 14934.First page Next page

Published 2026-09-25T18:28:25.584Z. Updated 2026-09-30T00:00:41.958Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:00 WIB

Official record

MedPublished 26 Sep 2026, 01:27 WIB

CVE-2026-45801

GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)

GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:27:33.123Z. Updated 2026-09-25T19:41:40.597Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:41 WIB

Official record

MedPublished 26 Sep 2026, 01:26 WIB

CVE-2026-53627

GLPI: Unexpected access to update operations through the API

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable au…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:26:37.407Z. Updated 2026-09-25T19:03:35.397Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:03 WIB

Official record

MedPublished 26 Sep 2026, 01:25 WIB

CVE-2026-49469

GLPI: LDAP filter injection in user import feature

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclud…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:25:43.769Z. Updated 2026-09-29T18:00:54.072Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:00 WIB

Official record

MedPublished 26 Sep 2026, 01:23 WIB

CVE-2026-63208

Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the token format Microsoft …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:23:47.098Z. Updated 2026-09-25T18:42:12.452Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:42 WIB

Official record

MedPublished 26 Sep 2026, 01:23 WIB

CVE-2026-63006

Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:23:13.578Z. Updated 2026-09-29T18:03:56.994Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:03 WIB

Official record

LowPublished 26 Sep 2026, 01:22 WIB

CVE-2026-63204

Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run belongs to a ticket the age…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:22:40.491Z. Updated 2026-09-25T18:41:43.228Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:41 WIB

Official record

MedPublished 26 Sep 2026, 01:21 WIB

CVE-2026-61855

Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid ("Good") PGP signature from a registered sender key, even though the displayed message content is not actually covere…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:21:55.462Z. Updated 2026-09-25T19:02:38.605Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:02 WIB

Official record

MedPublished 26 Sep 2026, 01:21 WIB

CVE-2026-84461

Zammad: Missing rate limiting allows password brute-forcing during two-factor login

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also revealed whether a guess was correct, even before two-factor authent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:21:20.015Z. Updated 2026-09-25T18:41:14.822Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:41 WIB

Official record

MedPublished 26 Sep 2026, 01:20 WIB

CVE-2026-63207

Zammad: Sensitive Information Exposure in Integration Administration API

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:20:44.058Z. Updated 2026-09-29T18:06:28.995Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:06 WIB

Official record

HighPublished 26 Sep 2026, 01:19 WIB

CVE-2026-84465

Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is already stored in the system…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:19:58.735Z. Updated 2026-09-29T18:08:05.375Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:08 WIB

Official record

MedPublished 26 Sep 2026, 01:19 WIB

CVE-2026-84463

Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML without being escaped for i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:19:19.193Z. Updated 2026-09-29T19:42:48.916Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:42 WIB

Official record

HighPublished 26 Sep 2026, 01:18 WIB

CVE-2026-84464

Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including its details in a request …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:18:40.193Z. Updated 2026-09-25T19:03:46.965Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:03 WIB

Official record

MedPublished 26 Sep 2026, 01:16 WIB

CVE-2026-63216

Zammad: Stored XSS via unescaped option labels in the object attribute options context UI

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An attacker who can control…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:16:01.483Z. Updated 2026-09-29T19:41:42.455Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:41 WIB

Official record

CritPublished 26 Sep 2026, 01:15 WIB

CVE-2026-84458

Zammad: Account takeover via unverified email matching during SSO auto-link

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party (SSO) identity to an existing local account by matching the email address the identity provider reports, without verifying that …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:15:26.900Z. Updated 2026-09-25T19:05:02.610Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:05 WIB

Official record

MedPublished 26 Sep 2026, 01:15 WIB

CVE-2026-97895

krayin laravel-crm User Management UserController.php privileges management

A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:15:17.276Z. Updated 2026-09-25T18:40:39.301Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:40 WIB

Official record

MedPublished 26 Sep 2026, 01:14 WIB

CVE-2026-84460

Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization feature and may contain …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:14:49.086Z. Updated 2026-09-29T18:09:59.192Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:09 WIB

Official record

MedPublished 26 Sep 2026, 01:14 WIB

CVE-2026-63206

Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme (for example a shortened HTTP URL instead of a shortened H…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:14:06.612Z. Updated 2026-09-25T19:46:54.438Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:46 WIB

Official record

MedPublished 26 Sep 2026, 01:13 WIB

CVE-2026-63205

Zammad: Channel admins can read unauthorized attachments via signature rich-text body

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any existing attachment, the system copies that attachment into a ne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:13:25.176Z. Updated 2026-09-29T19:40:34.778Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:40 WIB

Official record