Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 2141–2160 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 20 Apr 2026, 08:45 WIB

CVE-2026-6594

brikcss merge prototype pollution

A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument __proto__/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The vendor was contacted e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T01:45:12.099Z. Updated 2026-04-20T14:53:13.499Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:53 WIB

Official record

MedPublished 20 Apr 2026, 08:30 WIB

CVE-2026-6593

ComfyUI View Endpoint server.py cross site scripting

A vulnerability was found in ComfyUI up to 0.13.0. Affected by this issue is some unknown functionality of the file server.py of the component View Endpoint. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2141 to 2160 of 5813.First page Next page

Published 2026-04-20T01:30:17.995Z. Updated 2026-04-20T16:18:25.910Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 23:18 WIB

Official record

MedPublished 20 Apr 2026, 08:15 WIB

CVE-2026-6592

ComfyUI userdata Endpoint user_manager.py getuserdata cross site scripting

A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/user_manager.py of the component userdata Endpoint. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T01:15:14.548Z. Updated 2026-04-20T11:59:44.227Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 18:59 WIB

Official record

MedPublished 20 Apr 2026, 08:00 WIB

CVE-2026-6591

ComfyUI LoadImage Node folder_paths.py folder_paths.get_annotated_filepath path traversal

A flaw has been found in ComfyUI up to 0.13.0. Affected is the function folder_paths.get_annotated_filepath of the file folder_paths.py of the component LoadImage Node. This manipulation of the argument Name causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T01:00:18.496Z. Updated 2026-04-20T16:29:10.370Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 23:29 WIB

Official record

MedPublished 20 Apr 2026, 07:45 WIB

CVE-2026-6590

ComfyUI Model Preview Endpoint model_manager.py get_model_preview path traversal

A vulnerability was detected in ComfyUI up to 0.13.0. This impacts the function get_model_preview of the file app/model_manager.py of the component Model Preview Endpoint. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:45:11.883Z. Updated 2026-04-20T14:54:57.999Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:54 WIB

Official record

MedPublished 20 Apr 2026, 07:30 WIB

CVE-2026-6589

ComfyUI server.py create_origin_only_middleware cross-site request forgery

A security vulnerability has been detected in ComfyUI up to 0.13.0. This affects the function create_origin_only_middleware of the file server.py. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:30:21.353Z. Updated 2026-04-20T15:02:44.809Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 22:02 WIB

Official record

MedPublished 20 Apr 2026, 07:15 WIB

CVE-2026-6588

serge-chat serge Model API Endpoint model.py delete_model missing authentication

A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/routers/model.py of the component Model API Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:15:12.174Z. Updated 2026-04-20T16:15:13.000Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 23:15 WIB

Official record

MedPublished 20 Apr 2026, 07:00 WIB

CVE-2026-6587

vibrantlabsai RAGAS Collections util.py _try_process_url server-side request forgery

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:19.515Z. Updated 2026-07-15T00:41:18.374Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 07:41 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2025-66954

CVE-2025-66954

A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles. The issue is triggered by modifying a parameter within requests sent to the /nasapi endpoint.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-20T16:54:28.824Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Apr 2026, 23:54 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-26399

CVE-2026-26399

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle registry. After the function returns, interrupt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-22T19:53:16.622Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Apr 2026, 02:53 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-29642

CVE-2026-29642

A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menvcfg (e.g., csrrs in M-mode). On affected XiangShan versions (commit aecf601e803bfd2371667a3fb60bfcd83c333027, 2024-11-19), these menvcfg accesses can unexpectedly set WPRI (reserve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-21T19:50:54.758Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:50 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-29643

CVE-2026-29643

XiangShan (Open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) contains an improper exceptional-condition handling flaw in its CSR subsystem (NewCSR). On affected versions, certain sequences of CSR operations targeting non-existent/custom CSR addresses may trigger…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-21T19:50:32.463Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:50 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-29645

CVE-2026-29645

NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decoding vsetvli/vsetivli/vsetvl, allowing certain invalid OP-V instruction encodings to be misinterpreted and executed as vset*…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-21T19:51:06.424Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:51 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-29646

CVE-2026-29646

In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie) may be handled incorrectly and can influence machine-level interrupt enable state (mie). This breaks privilege/virtualization isolation and can lead to denial …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-21T19:50:49.314Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:50 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-29647

CVE-2026-29647

In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state via stopei/vstopei CSRs even when mstateen0.IMSIC is cleared, potentially enabling cross-context information leakage or disruption of interrupt handling.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-21T19:50:43.685Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:50 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-29648

CVE-2026-29648

In OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcfg and senvcfg. As a result, less-privileged code may read or write these CSRs without the required exception, potentially bypassing intended state-enable based isolation controls in virtualized or mul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-21T19:50:38.197Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:50 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-29649

CVE-2026-29649

NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode write to menvcfg can implicitly modify the hypervisor's environment configuration. This can lead to incorrect enforcement …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-21T19:51:00.279Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2026, 02:51 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-30266

CVE-2026-30266

Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-07-05T16:15:42.385Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:15 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-30269

CVE-2026-30269

Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via /platform/user/{username}. The `role` field is accepted by the update model without a manage_users permission check for self-updates, enabling privilege escalation to hi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-20T18:23:39.346Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Apr 2026, 01:23 WIB

Official record

UnscoredPublished 20 Apr 2026, 07:00 WIB

CVE-2026-39109

CVE-2026-39109

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter of the login page (index.php). This allows an unauthenticated attacker to manipulate backend SQL queries during authentication and retrieve sensitive database contents.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-20T00:00:00.000Z. Updated 2026-04-20T18:31:04.461Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Apr 2026, 01:31 WIB

Official record