Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,616 published records · 20 KEV · 4,616 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,616 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3317.2%
High1,42031%
Med1,98843%
Low2104.5%
None360.78%
Legacy00.00%
Unscored63114%

Matching records by UTC month

Feb 264,616

Signal coverage

KEV-listed: 20
With a forecast: 4,616
Unknown date: 0
Unscored severity: 631

Share of cohort: KEV 0.43% · forecast 100% · unscored 14%.

Showing 21–40 of 4,616By severity band: Critical · 9.0–10.0 331, High · 7.0–8.9 1,420, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 210, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 631

CritPublished 28 Feb 2026, 05:12 WIB

CVE-2026-28517

openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:12:08.889Z. Updated 2026-07-14T18:39:41.828Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:39 WIB

Official record

MedPublished 28 Feb 2026, 05:11 WIB

CVE-2026-28423

Statamic Vulnerable to Server-Side Request Forgery via Glide

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 21 to 40 of 4616.First page Next page

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:11:55.802Z. Updated 2026-03-02T21:48:43.597Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:48 WIB

Official record

CritPublished 28 Feb 2026, 05:11 WIB

CVE-2026-28516

openDCIM <= 23.04 SQL Injection in Config::UpdateParameter

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:11:52.246Z. Updated 2026-07-14T18:39:41.120Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:39 WIB

Official record

CritPublished 28 Feb 2026, 05:11 WIB

CVE-2026-28515

openDCIM <= 23.04 Missing Authorization in install.php

openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:11:37.303Z. Updated 2026-07-14T18:39:40.410Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:39 WIB

Official record

LowPublished 28 Feb 2026, 05:08 WIB

CVE-2026-28422

Vim has stack-buffer-overflow in build_stl_str_hl()

Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

Excerpt language: en.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:08:11.384Z. Updated 2026-03-02T21:45:53.806Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:45 WIB

Official record

MedPublished 28 Feb 2026, 05:06 WIB

CVE-2026-28421

Vim has a heap-buffer-overflow and a segmentation fault

Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:06:34.312Z. Updated 2026-05-28T13:27:22.600Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:27 WIB

Official record

MedPublished 28 Feb 2026, 05:04 WIB

CVE-2026-28420

Vim has Heap-based Buffer Overflow and OOB Read in :terminal

Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:04:36.189Z. Updated 2026-03-02T21:55:05.724Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:55 WIB

Official record

MedPublished 28 Feb 2026, 05:02 WIB

CVE-2026-28419

Vim has Heap-based Buffer Underflow in Emacs tags parsing

Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. V…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:02:55.952Z. Updated 2026-03-02T21:54:29.733Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:54 WIB

Official record

MedPublished 28 Feb 2026, 04:58 WIB

CVE-2026-28418

Vim has Heap-based Buffer Overflow in Emacs tags parsing

Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fix…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:58:37.277Z. Updated 2026-03-02T21:52:42.959Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:52 WIB

Official record

MedPublished 28 Feb 2026, 04:54 WIB

CVE-2026-28417

Vim has OS Command Injection in netrw

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:54:35.196Z. Updated 2026-05-28T13:27:36.137Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:27 WIB

Official record

CritPublished 28 Feb 2026, 04:52 WIB

CVE-2026-28411

WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vulnerability can be leveraged to completely bypass authentication checks, al…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:52:05.032Z. Updated 2026-03-02T21:58:06.757Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:58 WIB

Official record

CritPublished 28 Feb 2026, 04:50 WIB

CVE-2026-28409

WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authentication Bypass) can exec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:50:21.849Z. Updated 2026-03-02T21:58:36.963Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:58 WIB

Official record

CritPublished 28 Feb 2026, 04:49 WIB

CVE-2026-28408

WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malicious user could make a request through tools like Postman or the file's U…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:49:14.747Z. Updated 2026-03-02T21:59:11.926Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:59 WIB

Official record

HighPublished 28 Feb 2026, 04:47 WIB

CVE-2026-28416

Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses `gr.load()` to load a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:47:04.975Z. Updated 2026-03-02T21:59:40.942Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:59 WIB

Official record

MedPublished 28 Feb 2026, 04:44 WIB

CVE-2026-28415

Gradio has Open Redirect in OAuth Flow

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:44:51.956Z. Updated 2026-03-02T21:55:38.664Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:55 WIB

Official record

HighPublished 28 Feb 2026, 04:43 WIB

CVE-2026-28414

Gradio has Absolute Path Traversal on Windows with Python 3.13+

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ changed the definition of `os…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:43:28.453Z. Updated 2026-03-02T22:02:17.902Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 05:02 WIB

Official record

NonePublished 28 Feb 2026, 04:40 WIB

CVE-2026-27167

Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:40:57.917Z. Updated 2026-03-02T22:02:47.868Z.

CVSS0v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 05:02 WIB

Official record

HighPublished 28 Feb 2026, 04:34 WIB

CVE-2026-27939

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:34:39.107Z. Updated 2026-03-02T22:03:16.580Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 05:03 WIB

Official record

MedPublished 28 Feb 2026, 04:28 WIB

CVE-2026-28407

malcontent's nested archive extraction failure can drop content from scan inputs

malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:28:06.258Z. Updated 2026-03-02T22:01:48.514Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Mar 2026, 05:01 WIB

Official record

HighPublished 28 Feb 2026, 04:20 WIB

CVE-2026-28406

kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without enforcing that the final path stays within `dest`. A tar entry like `../…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:20:52.764Z. Updated 2026-07-15T01:11:46.081Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:11 WIB

Official record