Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 9,759 published records · 23 KEV · 9,759 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

9,759 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit9269.5%
High3,57237%
Med2,95330%
Low3183.3%
None120.12%
Legacy00.00%
Unscored1,97820%

Matching records by UTC month

Jul 269,759

Signal coverage

KEV-listed: 23
With a forecast: 9,759
Unknown date: 0
Unscored severity: 1,978

Share of cohort: KEV 0.24% · forecast 100% · unscored 20%.

Showing 21–40 of 9,759By severity band: Critical · 9.0–10.0 926, High · 7.0–8.9 3,572, Medium · 4.0–6.9 2,953, Low · 0.1–3.9 318, None · scored 0.0 12, Legacy · v2 only 0, Unscored · no CNA metric 1,978

MedPublished 01 Aug 2026, 02:16 WIB

CVE-2026-65841

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T19:16:05.952Z. Updated 2026-07-31T20:05:10.590Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 03:05 WIB

Official record

MedPublished 01 Aug 2026, 02:08 WIB

CVE-2026-62324

Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 21 to 40 of 9759.First page Next page

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T19:08:03.043Z. Updated 2026-08-03T17:26:47.204Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated04 Aug 2026, 00:26 WIB

Official record

LowPublished 01 Aug 2026, 02:07 WIB

CVE-2026-55825

Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T19:07:40.609Z. Updated 2026-07-31T23:33:16.171Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 06:33 WIB

Official record

LowPublished 01 Aug 2026, 02:04 WIB

CVE-2026-55824

Contao crawler leaks auth credentials to external hosts

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, clea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T19:04:00.322Z. Updated 2026-07-31T19:58:42.933Z.

CVSS2.6v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:58 WIB

Official record

HighPublished 01 Aug 2026, 02:03 WIB

CVE-2026-53502

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7.8.0.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T19:03:16.522Z. Updated 2026-07-31T19:18:09.047Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:18 WIB

Official record

HighPublished 01 Aug 2026, 02:00 WIB

CVE-2026-53505

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service. This issue is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T19:00:22.755Z. Updated 2026-08-03T17:20:37.186Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated04 Aug 2026, 00:20 WIB

Official record

HighPublished 01 Aug 2026, 01:57 WIB

CVE-2026-53504

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:57:19.257Z. Updated 2026-07-31T23:31:37.588Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 06:31 WIB

Official record

HighPublished 01 Aug 2026, 01:54 WIB

CVE-2026-53503

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:54:20.747Z. Updated 2026-07-31T21:39:35.108Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 04:39 WIB

Official record

HighPublished 01 Aug 2026, 01:42 WIB

CVE-2026-53501

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:42:42.360Z. Updated 2026-07-31T19:58:01.891Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:58 WIB

Official record

HighPublished 01 Aug 2026, 01:35 WIB

CVE-2026-53500

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:35:54.234Z. Updated 2026-07-31T23:30:44.046Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 06:30 WIB

Official record

LowPublished 01 Aug 2026, 01:29 WIB

CVE-2026-57232

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or private-address validation, allowing a backend user with module-edit permissions to mak…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:29:53.924Z. Updated 2026-08-03T17:24:45.798Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated04 Aug 2026, 00:24 WIB

Official record

MedPublished 01 Aug 2026, 01:12 WIB

CVE-2026-25552

Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain using the $proxy_add_x_f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:12:40.072Z. Updated 2026-08-14T16:49:40.070Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record

MedPublished 01 Aug 2026, 01:12 WIB

CVE-2026-18481

Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:12:23.067Z. Updated 2026-07-31T19:52:59.881Z.

CVSS6.2v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:52 WIB

Official record

MedPublished 01 Aug 2026, 01:04 WIB

CVE-2026-18321

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec

Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:04:06.697Z. Updated 2026-07-31T18:54:10.546Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:54 WIB

Official record

HighPublished 01 Aug 2026, 00:48 WIB

CVE-2026-54737

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in versio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:48:42.670Z. Updated 2026-07-31T19:00:41.074Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:00 WIB

Official record

CritPublished 01 Aug 2026, 00:45 WIB

CVE-2026-54725

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:45:09.548Z. Updated 2026-07-31T18:58:46.332Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:58 WIB

Official record

MedPublished 01 Aug 2026, 00:31 WIB

CVE-2026-34497

FMS Employee Vulnerable to HTML Injection

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:31:05.487Z. Updated 2026-07-31T18:10:50.071Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:10 WIB

Official record

MedPublished 01 Aug 2026, 00:30 WIB

CVE-2026-34495

FMS Employee vulnerable to XSS

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:30:52.669Z. Updated 2026-07-31T18:11:09.338Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:11 WIB

Official record

MedPublished 01 Aug 2026, 00:30 WIB

CVE-2026-21662

FMS Employee Allows Upload of Unrestricted Files

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:30:41.561Z. Updated 2026-07-31T18:24:41.723Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:24 WIB

Official record

MedPublished 01 Aug 2026, 00:17 WIB

CVE-2026-34490

XAAP Android Data Stored in Unencrypted Database

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:17:33.651Z. Updated 2026-07-31T17:38:49.752Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 00:38 WIB

Official record