Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 2081–2100 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 25 Sep 2026, 23:34 WIB

CVE-2026-67406

RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2 callback. When these processe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:34:06.122Z. Updated 2026-09-25T17:00:54.175Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:00 WIB

Official record

MedPublished 25 Sep 2026, 23:33 WIB

CVE-2026-95835

Missing ownership check on the shared memory object named by the kitty askpass escape code

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handle_remote_askpass() in kitty/window.py opens the POSIX shared memory object named in the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2081 to 2100 of 14934.First page Next page

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:33:30.323Z. Updated 2026-09-25T17:00:02.889Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:00 WIB

Official record

HighPublished 25 Sep 2026, 23:32 WIB

CVE-2026-67410

RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:32:51.225Z. Updated 2026-09-25T17:46:42.745Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:46 WIB

Official record

MedPublished 25 Sep 2026, 23:31 WIB

CVE-2026-67227

RabbitMQ: Atom exhaustion: to_atom on global-parameter :name

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resourceexists/2 (and the PUT/DELETE handlers) call rabbitdatacoercion:toatom/1 on the :name URL path segment. toatom/1 uses binarytoatom/2 (unsafe). The endpoint requ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:31:45.840Z. Updated 2026-09-25T17:48:04.204Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:48 WIB

Official record

MedPublished 25 Sep 2026, 23:30 WIB

CVE-2026-67407

RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex metacharacters in expanded topi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:30:35.252Z. Updated 2026-09-25T17:20:31.333Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:20 WIB

Official record

MedPublished 25 Sep 2026, 23:30 WIB

CVE-2026-97878

zhistaredu StarTraining Druid Console index.html anonymous missing authentication

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. The ven…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:30:07.246Z. Updated 2026-09-25T17:48:41.038Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:48 WIB

Official record

MedPublished 25 Sep 2026, 23:29 WIB

CVE-2026-67226

RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. An administrator can crash the node in a s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:29:13.662Z. Updated 2026-09-25T19:55:13.807Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:55 WIB

Official record

MedPublished 25 Sep 2026, 23:28 WIB

CVE-2026-95834

Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c holds a DragRemoteItem pointer into an array it does not own,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:28:09.295Z. Updated 2026-09-25T16:59:26.692Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated25 Sep 2026, 23:59 WIB

Official record

UnscoredPublished 25 Sep 2026, 23:27 WIB

CVE-2026-18311

CVE-2026-18311

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:27:54.187Z. Updated 2026-09-25T16:58:34.254Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2026, 23:58 WIB

Official record

UnscoredPublished 25 Sep 2026, 23:27 WIB

CVE-2026-18320

CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload', 'onerror'). An attacker could supply a document containing malicious …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:27:37.419Z. Updated 2026-09-25T16:57:42.082Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2026, 23:57 WIB

Official record

UnscoredPublished 25 Sep 2026, 23:27 WIB

CVE-2026-18312

CVE-2026-18312

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context enco…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:27:28.079Z. Updated 2026-09-25T16:56:33.452Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2026, 23:56 WIB

Official record

MedPublished 25 Sep 2026, 23:26 WIB

CVE-2026-67411

RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:26:33.880Z. Updated 2026-09-25T16:55:42.722Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated25 Sep 2026, 23:55 WIB

Official record

MedPublished 25 Sep 2026, 23:25 WIB

CVE-2026-67413

RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic exchange accepted a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator expanded percent and underscore wildcards into overlapping PCR…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:25:26.115Z. Updated 2026-09-29T19:30:15.380Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:30 WIB

Official record

MedPublished 25 Sep 2026, 23:22 WIB

CVE-2026-61837

RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET /bindings (the rabbitamqpmana…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:22:43.927Z. Updated 2026-09-29T19:27:59.221Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:27 WIB

Official record

MedPublished 25 Sep 2026, 23:22 WIB

CVE-2026-80432

Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop

Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop_enqueue_request() in kitty/dnd.c serves a drag data …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:22:09.394Z. Updated 2026-09-25T16:54:41.750Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated25 Sep 2026, 23:54 WIB

Official record

MedPublished 25 Sep 2026, 23:21 WIB

CVE-2026-67415

RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Exploitation requires network access to the Management HTTP API, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:21:04.828Z. Updated 2026-09-25T19:59:36.518Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 02:59 WIB

Official record

MedPublished 25 Sep 2026, 23:20 WIB

CVE-2026-67412

RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another vhost it has no permiss…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:20:13.605Z. Updated 2026-09-25T16:45:00.348Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated25 Sep 2026, 23:45 WIB

Official record

HighPublished 25 Sep 2026, 23:18 WIB

CVE-2026-67409

RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downlo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:18:25.611Z. Updated 2026-09-25T17:49:48.064Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:49 WIB

Official record

MedPublished 25 Sep 2026, 23:16 WIB

CVE-2026-67242

RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' and fall through to ok/never for float values. josejwt:verify v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:16:14.558Z. Updated 2026-09-25T20:01:12.537Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 03:01 WIB

Official record

MedPublished 25 Sep 2026, 23:15 WIB

CVE-2026-97877

zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password

A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml of the component JWT Token Handler. This manipulation of the argument user_id/company_id causes use of hard-coded password. The attack is possible to be carried…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-25T16:15:10.564Z. Updated 2026-09-25T17:21:34.774Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Sep 2026, 00:21 WIB

Official record