Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 2061–2080 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 26 Sep 2026, 00:04 WIB

CVE-2026-56731

Zammad: Cross-Site Scripting in Ticket Notifications

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization. This issue is fixed in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:04:50.332Z. Updated 2026-09-25T19:42:58.050Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:42 WIB

Official record

MedPublished 26 Sep 2026, 00:04 WIB

CVE-2026-56735

Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer (HtmlSanitizer::Strict) blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight allows an attacker t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2061 to 2080 of 14934.First page Next page

Published 2026-09-25T17:04:03.247Z. Updated 2026-09-25T19:06:35.154Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:06 WIB

Official record

HighPublished 26 Sep 2026, 00:02 WIB

CVE-2026-56727

Zammad: PGP signature spoofing via unvalidated verification return

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler unconditionally wrote sign: {…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:02:39.020Z. Updated 2026-09-25T17:42:09.284Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:42 WIB

Official record

MedPublished 26 Sep 2026, 00:01 WIB

CVE-2026-56734

Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication (OAuth/OIDC/SAML), a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider may cause the server…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:01:46.738Z. Updated 2026-09-29T19:34:59.004Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:34 WIB

Official record

MedPublished 26 Sep 2026, 00:01 WIB

CVE-2026-56726

Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of GitHub/GitLab issues attached …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:01:00.957Z. Updated 2026-09-25T19:44:08.495Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:44 WIB

Official record

MedPublished 26 Sep 2026, 00:00 WIB

CVE-2026-93366

Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints. Attackers can retriev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:00:44.083Z. Updated 2026-10-01T15:22:02.193Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:22 WIB

Official record

MedPublished 26 Sep 2026, 00:00 WIB

CVE-2026-97882

mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lead to sql injection. It …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T17:00:14.463Z. Updated 2026-09-29T19:33:32.236Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:33 WIB

Official record

HighPublished 25 Sep 2026, 23:58 WIB

CVE-2026-93365

Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX endpoint in bl-kernel/a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:58:40.834Z. Updated 2026-10-01T15:22:01.597Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:22 WIB

Official record

LowPublished 25 Sep 2026, 23:58 WIB

CVE-2026-56729

Zammad: Titles of knowledge base answers will be shown across all categories via the global search

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from categories they do not have editor access to , via the global quick…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:58:05.257Z. Updated 2026-09-25T17:09:29.330Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:09 WIB

Official record

MedPublished 25 Sep 2026, 23:57 WIB

CVE-2026-93364

Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and username through the Pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:57:38.544Z. Updated 2026-10-01T15:22:00.961Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:22 WIB

Official record

MedPublished 25 Sep 2026, 23:53 WIB

CVE-2026-93363

Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the req…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:53:12.583Z. Updated 2026-10-01T15:22:00.369Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:22 WIB

Official record

HighPublished 25 Sep 2026, 23:48 WIB

CVE-2026-56723

Zammad: Missing authorization on ticket attachment download

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachment download endpoint, b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:48:34.242Z. Updated 2026-09-25T17:44:24.357Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:44 WIB

Official record

UnscoredPublished 25 Sep 2026, 23:47 WIB

CVE-2026-100237

Stored i18n XSS in the Flow integration of Thanks

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45.5/1.46.1.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:47:40.595Z. Updated 2026-09-25T17:06:21.602Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:06 WIB

Official record

HighPublished 25 Sep 2026, 23:46 WIB

CVE-2026-56724

Zammad: Incorrect implementation of permission checks in the knowledge base module

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users with limited read permis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:46:50.420Z. Updated 2026-09-25T17:45:13.696Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:45 WIB

Official record

MedPublished 25 Sep 2026, 23:45 WIB

CVE-2026-97879

zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:45:14.557Z. Updated 2026-09-25T17:02:21.977Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:02 WIB

Official record

UnscoredPublished 25 Sep 2026, 23:43 WIB

CVE-2026-94445

Malicious user input may lead to RCE in golang.org/x/playground

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read fo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:43:06.941Z. Updated 2026-09-25T17:08:14.767Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:08 WIB

Official record

LowPublished 25 Sep 2026, 23:42 WIB

CVE-2026-67420

RabbitMQ OAuth credential refresh retains revoked runtime tags

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username token that no longer grants…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:42:49.000Z. Updated 2026-09-29T19:32:12.337Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:32 WIB

Official record

HighPublished 25 Sep 2026, 23:41 WIB

CVE-2026-67419

RabbitMQ: Consecutive topic wildcards cause combinatorial routing work

RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materialize…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:41:08.104Z. Updated 2026-09-25T17:01:50.884Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:01 WIB

Official record

MedPublished 25 Sep 2026, 23:39 WIB

CVE-2026-67421

RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:39:02.323Z. Updated 2026-09-25T19:58:22.877Z.

CVSS4.5v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:58 WIB

Official record

HighPublished 25 Sep 2026, 23:35 WIB

CVE-2026-67408

RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service

RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:35:22.829Z. Updated 2026-09-25T19:09:53.750Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:09 WIB

Official record