Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filtersnone active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 397,835 published records · 1,762 KEV · 397,508 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

397,835 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit16,4754.1%
High70,95918%
Med84,65121%
Low8,6292.2%
None1100.03%
Legacy1230.03%
Unscored216,88855%

Matching records by UTC month

Nov 244,054
Dec 243,433
Jan 254,273
Feb 253,673
Mar 254,001
Apr 254,033

Signal coverage

KEV-listed: 1,762
With a forecast: 397,508
Unknown date: 0
Unscored severity: 216,888

Share of cohort: KEV 0.44% · forecast 100% · unscored 55%.

Showing 21–40 of 397,835By severity band: Critical · 9.0–10.0 16,475, High · 7.0–8.9 70,959, Medium · 4.0–6.9 84,651, Low · 0.1–3.9 8,629, None · scored 0.0 110, Legacy · v2 only 123, Unscored · no CNA metric 216,888

HighPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119127

ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:09.747Z. Updated 2026-10-29T15:58:09.747Z.

CVSS8.6v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

LowPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119126

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 21 to 40 of 397835.First page Next page

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:09.005Z. Updated 2026-10-29T15:58:09.005Z.

CVSS2.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

LowPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119125

Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields

Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an object whose beforeSave trigger reverts a field, via revert(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:08.254Z. Updated 2026-10-29T15:58:08.254Z.

CVSS2.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119124

ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:07.508Z. Updated 2026-10-29T15:58:07.508Z.

CVSS4.8v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119123

ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:06.685Z. Updated 2026-10-29T15:58:06.685Z.

CVSS6.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119122

Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-met…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:05.930Z. Updated 2026-10-29T15:58:05.930Z.

CVSS6.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119121

Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. Attackers can inject quotes into css_selector or supply js: conditions in wait_for…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:05.117Z. Updated 2026-10-29T15:58:05.117Z.

CVSS5.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

HighPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119120

Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:04.414Z. Updated 2026-10-29T15:58:04.414Z.

CVSS7.7v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

HighPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119119

Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:03.704Z. Updated 2026-10-29T15:58:03.704Z.

CVSS8.7v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

HighPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119118

Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags

Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:02.951Z. Updated 2026-10-29T15:58:02.951Z.

CVSS8.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

MedPublished 29 Oct 2026, 22:57 WIB

CVE-2026-90872

Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker proces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:57:24.826Z. Updated 2026-10-29T15:57:24.826Z.

CVSS6.6v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:57 WIB

Official record

MedPublished 29 Oct 2026, 22:56 WIB

CVE-2026-90871

Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server

Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:56:34.762Z. Updated 2026-10-29T15:56:34.762Z.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:56 WIB

Official record

MedPublished 29 Oct 2026, 22:55 WIB

CVE-2026-90870

Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:55:43.950Z. Updated 2026-10-29T15:55:43.950Z.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:55 WIB

Official record

HighPublished 29 Oct 2026, 22:54 WIB

CVE-2026-90869

Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server

A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:54:48.769Z. Updated 2026-10-29T15:54:48.769Z.

CVSS7.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:54 WIB

Official record

CritPublished 29 Oct 2026, 22:53 WIB

CVE-2026-90868

OS Command Injection in Progress WS_FTP Server

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:53:59.315Z. Updated 2026-10-29T15:53:59.315Z.

CVSS9.9v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:53 WIB

Official record

HighPublished 29 Oct 2026, 22:53 WIB

CVE-2026-90867

Improper Access Control of Web Admin Console in Progress WS_FTP Server

Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:53:12.203Z. Updated 2026-10-29T15:53:12.203Z.

CVSS8.1v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:53 WIB

Official record

CritPublished 29 Oct 2026, 22:52 WIB

CVE-2026-90866

Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:52:24.790Z. Updated 2026-10-29T15:52:24.790Z.

CVSS9.1v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:52 WIB

Official record

CritPublished 29 Oct 2026, 22:51 WIB

CVE-2026-90865

Command Injection via FTP Notification Variables in Progress WS_FTP Server

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.

Excerpt language: en.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:51:35.058Z. Updated 2026-10-29T15:51:35.058Z.

CVSS9v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:51 WIB

Official record

CritPublished 29 Oct 2026, 22:50 WIB

CVE-2026-90864

Host Administrator Path Containment Bypass in Progress WS_FTP Server

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:50:29.084Z. Updated 2026-10-29T15:50:29.084Z.

CVSS9.1v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:50 WIB

Official record

CritPublished 29 Oct 2026, 22:49 WIB

CVE-2026-90863

Privilege Escalation via Missing Authorization in WS_FTP Manager

Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:49:34.111Z. Updated 2026-10-29T15:49:34.111Z.

CVSS9.1v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:49 WIB

Official record