Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2141–2160 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 27 Oct 2026, 00:06 WIB

CVE-2026-72752

Routinator exits when requesting the output repeatedly

Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T17:06:15.152Z. Updated 2026-10-26T17:57:34.344Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:57 WIB

Official record

MedPublished 27 Oct 2026, 00:00 WIB

CVE-2026-116384

Bdtask Garage 24 Garage Management Software Backend improper authorization

A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vulnerability affects unknown code of the component Backend. Executing a manipulation can lead to improper authorization. The attack can be launched remotely. The exploit has been made available to the public and could be used for a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2141 to 2160 of 16156.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T17:00:19.729Z. Updated 2026-10-26T17:00:19.729Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:00 WIB

Official record

MedPublished 26 Oct 2026, 23:56 WIB

CVE-2026-115913

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forward_attention to materialize an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:56:59.817Z. Updated 2026-10-26T16:56:59.817Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:56 WIB

Official record

HighPublished 26 Oct 2026, 23:54 WIB

CVE-2026-115912

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pas…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:54:00.643Z. Updated 2026-10-26T19:35:42.879Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:35 WIB

Official record

HighPublished 26 Oct 2026, 23:48 WIB

CVE-2026-116612

CVE-2026-116612

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:48:37.293Z. Updated 2026-10-27T03:55:30.986Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 10:55 WIB

Official record

MedPublished 26 Oct 2026, 23:47 WIB

CVE-2026-115911

vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.apply_chat_template()…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:47:59.377Z. Updated 2026-10-26T16:47:59.377Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:47 WIB

Official record

MedPublished 26 Oct 2026, 23:46 WIB

CVE-2026-116395

WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:46:39.501Z. Updated 2026-10-26T17:37:09.389Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:37 WIB

Official record

MedPublished 26 Oct 2026, 23:45 WIB

CVE-2013-10077

OctoPrint API Key settings.py getSettings information disclosure

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:45:16.290Z. Updated 2026-10-26T16:45:16.290Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:45 WIB

Official record

MedPublished 26 Oct 2026, 23:45 WIB

CVE-2026-115598

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:45:11.621Z. Updated 2026-10-26T17:37:09.543Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:37 WIB

Official record

MedPublished 26 Oct 2026, 23:44 WIB

CVE-2026-115910

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py uses get_and_store_nonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exist…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:44:34.337Z. Updated 2026-10-26T16:44:34.337Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:44 WIB

Official record

MedPublished 26 Oct 2026, 23:43 WIB

CVE-2026-114710

WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:43:59.208Z. Updated 2026-10-26T17:37:09.711Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:37 WIB

Official record

MedPublished 26 Oct 2026, 23:43 WIB

CVE-2026-115597

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:43:22.281Z. Updated 2026-10-26T17:37:09.885Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:37 WIB

Official record

MedPublished 26 Oct 2026, 23:42 WIB

CVE-2026-116388

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:42:54.795Z. Updated 2026-10-26T17:37:10.026Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:37 WIB

Official record

MedPublished 26 Oct 2026, 23:39 WIB

CVE-2026-116396

WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:39:18.840Z. Updated 2026-10-26T17:37:10.212Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:37 WIB

Official record

HighPublished 26 Oct 2026, 23:39 WIB

CVE-2026-115418

SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha

SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, inclu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:39:08.909Z. Updated 2026-10-26T18:13:10.227Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 01:13 WIB

Official record

HighPublished 26 Oct 2026, 23:39 WIB

CVE-2026-115909

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:39:00.037Z. Updated 2026-10-26T19:48:35.352Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:48 WIB

Official record

MedPublished 26 Oct 2026, 23:37 WIB

CVE-2026-116403

WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:37:59.242Z. Updated 2026-10-26T17:37:10.367Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:37 WIB

Official record

HighPublished 26 Oct 2026, 23:34 WIB

CVE-2026-115908

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix compariso…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:34:29.328Z. Updated 2026-10-26T19:36:11.803Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:36 WIB

Official record

HighPublished 26 Oct 2026, 23:32 WIB

CVE-2026-115907

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:32:15.373Z. Updated 2026-10-26T16:32:15.373Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:32 WIB

Official record

MedPublished 26 Oct 2026, 23:30 WIB

CVE-2026-115906

zip: AES Entry HMAC Authentication Bypass on Premature EOF

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while data_remaining is still p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T16:30:30.954Z. Updated 2026-10-26T16:30:30.954Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:30 WIB

Official record