Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 2161–2180 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 22 Mar 2026, 20:38 WIB

CVE-2019-25593

jetCast Server 2.0 Denial of Service via Log Directory

jetCast Server 2.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Log directory configuration field. Attackers can paste a buffer of 5000 characters into the Log directory input, then click Start to trigger a crash that term…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T13:38:31.056Z. Updated 2026-03-23T19:25:09.947Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 02:25 WIB

Official record

MedPublished 22 Mar 2026, 20:38 WIB

CVE-2019-25592

PHPRunner 10.1 Denial of Service via Dashboard Name Field

PHPRunner 10.1 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the dashboard name field. Attackers can paste a buffer of 10000 characters into the Name field during dashboard creation to trigger an application crash.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2161 to 2180 of 6236.First page Next page

Published 2026-03-22T13:38:30.411Z. Updated 2026-03-23T16:04:17.974Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:04 WIB

Official record

MedPublished 22 Mar 2026, 20:38 WIB

CVE-2019-25591

DNSS Domain Name Search Software 2.1.8 Denial of Service

DNSS Domain Name Search Software 2.1.8 contains a buffer overflow vulnerability in the registration code input field that allows local attackers to crash the application by submitting an excessively long string. Attackers can trigger a denial of service by pasting a malicious registration code containing 300 repeated c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T13:38:29.521Z. Updated 2026-03-24T14:38:35.595Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:38 WIB

Official record

MedPublished 22 Mar 2026, 20:38 WIB

CVE-2019-25590

Axessh 4.2 Denial of Service via Log File Name

Axessh 4.2 contains a denial of service vulnerability in the logging configuration that allows local attackers to crash the application by supplying an excessively long string in the log file name field. Attackers can enable session logging, paste a buffer of 500 or more characters into the log file name parameter, and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T13:38:28.762Z. Updated 2026-03-23T15:31:59.793Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 22:31 WIB

Official record

MedPublished 22 Mar 2026, 20:02 WIB

CVE-2026-4548

mickasmt next-saas-stripe-starter update-user-role.ts updateUserrole improper authorization

A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0. Affected by this vulnerability is the function updateUserrole of the file actions/update-user-role.ts. The manipulation of the argument userId/role results in improper authorization. The attack may be launched remotely.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T13:02:44.410Z. Updated 2026-03-23T16:06:10.980Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:06 WIB

Official record

MedPublished 22 Mar 2026, 20:02 WIB

CVE-2026-4547

mickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic error

A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the file actions/generate-user-stripe.ts of the component Checkout Handler. The manipulation of the argument priceId leads to business logic errors. The attack may be initiated remotely.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T13:02:42.292Z. Updated 2026-03-23T16:32:58.898Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:32 WIB

Official record

HighPublished 22 Mar 2026, 20:02 WIB

CVE-2026-4546

Flos Freeware Notepad2 TextShaping.dll uncontrolled search path

A weakness has been identified in Flos Freeware Notepad2 4.2.25. This impacts an unknown function in the library TextShaping.dll. Executing a manipulation can lead to uncontrolled search path. The attack is restricted to local execution. The attack requires a high level of complexity. The exploitability is said to be d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T13:02:40.125Z. Updated 2026-03-23T16:39:39.426Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:39 WIB

Official record

MedPublished 22 Mar 2026, 19:15 WIB

CVE-2026-4115

PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification

A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the component Ed25519 Signature Handler. The manipulation results in improper verification of cryptographic signature. The attack may be performed from remote. The attack requires a high level of complexity…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T12:15:07.531Z. Updated 2026-05-25T01:42:39.715Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated25 May 2026, 08:42 WIB

Official record

HighPublished 22 Mar 2026, 18:20 WIB

CVE-2026-4545

Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path

A security flaw has been discovered in Flos Freeware Notepad2 4.2.25. This affects an unknown function in the library PROPSYS.dll. Performing a manipulation results in uncontrolled search path. The attack is only possible with local access. The attack is considered to have high complexity. The exploitability is reporte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T11:20:57.774Z. Updated 2026-03-24T14:34:17.765Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:34 WIB

Official record

MedPublished 22 Mar 2026, 16:58 WIB

CVE-2026-4544

Wavlink WL-WN578W2 POST Request login.cgi cross site scripting

A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Handler. Executing a manipulation of the argument homepage/hostname/login_page can lead to cross site scripting. It is possible to launch the attack remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T09:58:12.417Z. Updated 2026-03-23T16:07:56.364Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:07 WIB

Official record

MedPublished 22 Mar 2026, 16:23 WIB

CVE-2026-4543

Wavlink WL-WN578W2 POST Request firewall.cgi command injection

A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is an unknown function of the file /cgi-bin/firewall.cgi of the component POST Request Handler. Performing a manipulation of the argument dmz_flag/del_flag results in command injection. It is possible to initiate the attack remotely. The explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T09:23:28.522Z. Updated 2026-03-23T16:22:35.195Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:22 WIB

Official record

MedPublished 22 Mar 2026, 15:35 WIB

CVE-2026-4542

SSCMS layerImage Endpoint LayerImageController.Submit.cs path traversal

A vulnerability has been found in SSCMS 4.7.0. The affected element is an unknown function of the file LayerImageController.Submit.cs of the component layerImage Endpoint. Such manipulation of the argument filePaths leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T08:35:10.929Z. Updated 2026-04-18T03:38:56.405Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 10:38 WIB

Official record

LowPublished 22 Mar 2026, 15:35 WIB

CVE-2026-4541

janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification

A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T08:35:03.623Z. Updated 2026-04-18T03:39:33.191Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 10:39 WIB

Official record

MedPublished 22 Mar 2026, 14:41 WIB

CVE-2026-4540

projectworlds Online Notes Sharing System Parameters login.php sql injection

A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the component Parameters Handler. The manipulation of the argument User results in sql injection. The attack can be executed remotely. The exploit is now public and may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T07:41:05.649Z. Updated 2026-03-24T14:33:25.772Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:33 WIB

Official record

MedPublished 22 Mar 2026, 12:35 WIB

CVE-2026-4539

pygments archetype.py AdlLexer redos

A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T05:35:12.096Z. Updated 2026-03-23T16:08:49.809Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:08 WIB

Official record

MedPublished 22 Mar 2026, 11:20 WIB

CVE-2026-4538

PyTorch pt2 Loading deserialization

A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T04:20:28.356Z. Updated 2026-03-23T16:21:46.022Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:21 WIB

Official record

MedPublished 22 Mar 2026, 11:02 WIB

CVE-2026-4537

Cudy TR1200 ipsec.lua action_ipsec_conn command injection

A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be uti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T04:02:14.160Z. Updated 2026-04-29T05:52:54.859Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 12:52 WIB

Official record

MedPublished 22 Mar 2026, 11:02 WIB

CVE-2026-4536

Acrel Environmental Monitoring Cloud Platform unrestricted upload

A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1.1.0. This issue affects some unknown processing. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T04:02:11.372Z. Updated 2026-03-23T15:36:30.479Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 22:36 WIB

Official record

HighPublished 22 Mar 2026, 10:32 WIB

CVE-2026-4535

Tenda FH451 WrlclientSet stack-based overflow

A vulnerability has been found in Tenda FH451 1.0.0.9. This vulnerability affects the function WrlclientSet of the file /goform/WrlclientSet. Such manipulation of the argument GO leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T03:32:14.994Z. Updated 2026-03-24T14:30:09.933Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:30 WIB

Official record

HighPublished 22 Mar 2026, 10:32 WIB

CVE-2026-4534

Tenda FH451 WrlExtraSet formWrlExtraSet stack-based overflow

A flaw has been found in Tenda FH451 1.0.0.9. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. This manipulation of the argument GO causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-22T03:32:11.313Z. Updated 2026-03-23T16:15:14.053Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:15 WIB

Official record