Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 2041–2060 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

CritPublished 26 Sep 2026, 01:12 WIB

CVE-2026-97064

X-SpringBoot through 6.0 Authentication Bypass via Static Master Code

X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:12:19.819Z. Updated 2026-09-30T17:29:32.113Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:29 WIB

Official record

CritPublished 26 Sep 2026, 01:12 WIB

CVE-2026-97063

X-SpringBoot through 6.0 Authentication Bypass via Login Code

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2041 to 2060 of 14934.First page Next page

Published 2026-09-25T18:12:19.119Z. Updated 2026-09-25T18:40:04.260Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:40 WIB

Official record

HighPublished 26 Sep 2026, 01:12 WIB

CVE-2026-97060

X-SpringBoot through 6.0 Authorization Bypass via User Management

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users vi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:12:18.423Z. Updated 2026-09-29T18:23:02.488Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:23 WIB

Official record

MedPublished 26 Sep 2026, 01:12 WIB

CVE-2026-100192

X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and im…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:12:17.702Z. Updated 2026-09-29T19:38:51.593Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:38 WIB

Official record

MedPublished 26 Sep 2026, 01:00 WIB

CVE-2026-97886

mathurvishal CloudClassroom-PHP-Project managevideos2.php sql injection

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be launched remotely. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T18:00:16.790Z. Updated 2026-09-29T18:10:56.793Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:10 WIB

Official record

HighPublished 26 Sep 2026, 00:56 WIB

CVE-2026-91841

Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege escalation.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:56:34.223Z. Updated 2026-09-28T12:43:47.658Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:43 WIB

Official record

HighPublished 26 Sep 2026, 00:56 WIB

CVE-2026-91840

Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connect…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:56:32.736Z. Updated 2026-09-28T12:44:17.583Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:44 WIB

Official record

HighPublished 26 Sep 2026, 00:56 WIB

CVE-2026-91839

Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:56:31.225Z. Updated 2026-09-28T12:44:46.096Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 19:44 WIB

Official record

HighPublished 26 Sep 2026, 00:51 WIB

CVE-2026-91838

Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields

A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then proce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:51:44.357Z. Updated 2026-09-25T18:16:17.928Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:16 WIB

Official record

MedPublished 26 Sep 2026, 00:45 WIB

CVE-2026-97885

mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:45:06.202Z. Updated 2026-09-25T18:10:30.478Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:10 WIB

Official record

MedPublished 26 Sep 2026, 00:30 WIB

CVE-2026-97884

mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The attack can be launched …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:30:10.674Z. Updated 2026-09-25T18:39:31.824Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:39 WIB

Official record

HighPublished 26 Sep 2026, 00:29 WIB

CVE-2026-84462

Zammad: AI Agent template sanitizer bypass leads to remote code execution

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypassed by entering specially crafted text into one of an AI Agent's fields. An administrator with permission to create or edit AI Agents could exploit this to run …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:29:15.837Z. Updated 2026-09-25T18:11:30.745Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:11 WIB

Official record

LowPublished 26 Sep 2026, 00:28 WIB

CVE-2026-65828

Zammad: Pending upload deletion bypass via legacy attachment endpoint

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroy_form action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied form_id without verifying that the requesting user owns those records. An authenticated attacker who learns anothe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:28:13.159Z. Updated 2026-09-25T18:38:58.822Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:38 WIB

Official record

MedPublished 26 Sep 2026, 00:15 WIB

CVE-2026-97883

mathurvishal CloudClassroom-PHP-Project updatequery.php sql injection

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. The manipulation of the argument gid leads to sql injection. The attack can be initiated remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:15:05.865Z. Updated 2026-09-25T17:27:48.523Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:27 WIB

Official record

HighPublished 26 Sep 2026, 00:11 WIB

CVE-2026-61525

Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller

Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to construct internal file p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:11:33.499Z. Updated 2026-09-25T17:31:01.884Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:31 WIB

Official record

MedPublished 26 Sep 2026, 00:10 WIB

CVE-2026-56728

Zammad: Cross-User Taskbar Item Access Control Vulnerability

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. The taskbar feature stor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:10:16.262Z. Updated 2026-09-25T18:38:22.817Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:38 WIB

Official record

HighPublished 26 Sep 2026, 00:09 WIB

CVE-2026-56725

Zammad: Denial of Service via OTRS Import Controller

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check blocks a Zammad request worker for roughly two minutes. The import_check and import_status actions are missing the setup_done_response guard that other actions …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:09:05.633Z. Updated 2026-09-29T19:37:24.906Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:37 WIB

Official record

MedPublished 26 Sep 2026, 00:08 WIB

CVE-2026-56732

Zammad: Malicious input in Ticket Body Enables Session Termination

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating the viewer's session. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:08:20.324Z. Updated 2026-09-25T17:41:20.304Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:41 WIB

Official record

LowPublished 26 Sep 2026, 00:07 WIB

CVE-2026-56730

Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a knowledge base answer su…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:07:02.910Z. Updated 2026-09-29T19:35:59.021Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:35 WIB

Official record

HighPublished 26 Sep 2026, 00:05 WIB

CVE-2026-56733

Zammad: Incorrect Authorization and Improper Privilege Management

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new identity objects exhibits a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:05:56.215Z. Updated 2026-09-25T18:37:48.132Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 01:37 WIB

Official record