Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2201–2220 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 26 Oct 2026, 21:52 WIB

CVE-2026-99093

mm: don't schedule deferred kernel page table freeing while booting

In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Booting with a boot-time function tracer and a filter, for example ftrace=function ftrace_filter=pud_free_pmd_page panics on 7.3-rc4 as soon as the tracer starts: [ 23.53117…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:52:01.450Z. Updated 2026-10-26T14:52:01.450Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:52 WIB

Official record

UnscoredPublished 26 Oct 2026, 21:52 WIB

CVE-2026-99092

riscv: patch: fix handling of bpf-jit execmem addresses

In the Linux kernel, the following vulnerability has been resolved: riscv: patch: fix handling of bpf-jit execmem addresses Commit 8718e5a3090b ("riscv: patch: skip fixmap mapping when kernel text is already writable") gated the core_kernel_text() branch of patch_map() on CONFIG_STRICT_KERNEL_RWX, and explicitly left…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2201 to 2220 of 16156.First page Next page

Published 2026-10-26T14:52:00.860Z. Updated 2026-10-26T14:52:00.860Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:52 WIB

Official record

UnscoredPublished 26 Oct 2026, 21:52 WIB

CVE-2026-99091

Bluetooth: MGMT: Fix status of pending commands flushed on power off

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix status of pending commands flushed on power off cmd_complete_rsp() receives a struct cmd_lookup and, for a pending command that has no cmd_complete callback, falls through to cmd_status_rsp(cmd, data). cmd_status_rsp() reads data…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:52:00.262Z. Updated 2026-10-26T14:52:00.262Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:52 WIB

Official record

UnscoredPublished 26 Oct 2026, 21:51 WIB

CVE-2026-99090

drm/amdgpu: serialize vblank counter reads against GPU reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: serialize vblank counter reads against GPU reset The vblank counter callback reads display registers and scanout position without holding reset_domain->sem. During GPU recovery, display commit work can call the callback while reset owns t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:51:59.654Z. Updated 2026-10-27T15:53:00.938Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Oct 2026, 22:53 WIB

Official record

UnscoredPublished 26 Oct 2026, 21:51 WIB

CVE-2026-99089

ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM

In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM The probe function puts the device into the runtime PM active state with only the "iis" bus clock enabled, but it also sets priv->op_clk to the parent of the RCLK_SRC mux without enabli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:51:59.055Z. Updated 2026-10-26T14:51:59.055Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:51 WIB

Official record

UnscoredPublished 26 Oct 2026, 21:51 WIB

CVE-2026-99088

net: openvswitch: validate transport header presence in set_ipv6_addr

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set_ipv6_addr When executing IPv6 address rewrite actions on IPv6 fragments, set_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr() processes a non-first IPv6 fragment, it sets key->ip…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:51:58.460Z. Updated 2026-10-26T14:51:58.460Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:51 WIB

Official record

HighPublished 26 Oct 2026, 21:47 WIB

CVE-2026-90885

Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default S…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:47:03.155Z. Updated 2026-10-26T15:35:49.414Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

MedPublished 26 Oct 2026, 21:46 WIB

CVE-2026-77062

Clickjacking in boneIO

The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. This can lead to unauthorized state …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:46:12.663Z. Updated 2026-10-26T15:35:49.560Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

MedPublished 26 Oct 2026, 21:46 WIB

CVE-2026-94386

Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2. OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through the client credentials grant on behalf of the components that authenticate their outb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:46:11.551Z. Updated 2026-10-26T15:35:49.712Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

MedPublished 26 Oct 2026, 21:46 WIB

CVE-2026-77061

Missing Authentication for Critical Function in boneIO

boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:46:09.722Z. Updated 2026-10-26T15:35:49.857Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

MedPublished 26 Oct 2026, 21:46 WIB

CVE-2026-77060

Incorrect Permission Assignment for Critical Resource in boneIO

boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:46:06.547Z. Updated 2026-10-26T15:35:49.996Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

HighPublished 26 Oct 2026, 21:46 WIB

CVE-2026-77059

TOCTOU Race Condition in boneIO

boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race window between val…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:46:02.659Z. Updated 2026-10-26T15:35:50.139Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

MedPublished 26 Oct 2026, 21:45 WIB

CVE-2026-77058

Cross-Site Request Forgery (CSRF) in boneIO

boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin requests to the devic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:45:59.416Z. Updated 2026-10-26T16:46:44.686Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:46 WIB

Official record

LowPublished 26 Oct 2026, 21:45 WIB

CVE-2026-77057

Improper Restriction of Excessive Authentication Attempts in boneIO

boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:45:56.237Z. Updated 2026-10-26T14:45:56.237Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:45 WIB

Official record

HighPublished 26 Oct 2026, 21:45 WIB

CVE-2026-77056

Use of Default Credentials in boneIO

boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:45:53.279Z. Updated 2026-10-26T16:46:44.867Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:46 WIB

Official record

CritPublished 26 Oct 2026, 21:45 WIB

CVE-2026-77055

Improper Privilege Assignment in boneIO

boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0: the image removes the sudoe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:45:49.260Z. Updated 2026-10-26T14:45:49.260Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:45 WIB

Official record

MedPublished 26 Oct 2026, 21:45 WIB

CVE-2026-77054

Cleartext Storage of Sensitive Information in boneIO

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form. Critically, due to CVE-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:45:45.813Z. Updated 2026-10-26T16:46:45.059Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:46 WIB

Official record

HighPublished 26 Oct 2026, 21:45 WIB

CVE-2026-77053

Missing Authentication in Default Configuration in boneIO

boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:45:42.165Z. Updated 2026-10-26T14:45:42.165Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:45 WIB

Official record

HighPublished 26 Oct 2026, 21:45 WIB

CVE-2026-77052

Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:45:37.056Z. Updated 2026-10-26T14:45:37.056Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:45 WIB

Official record

MedPublished 26 Oct 2026, 21:45 WIB

CVE-2026-116340

iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization

A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The attack may be launched re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:45:22.395Z. Updated 2026-10-26T14:45:22.395Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:45 WIB

Official record