Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,616 published records · 20 KEV · 4,616 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,616 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3317.2%
High1,42031%
Med1,98843%
Low2104.5%
None360.78%
Legacy00.00%
Unscored63114%

Matching records by UTC month

Feb 264,616

Signal coverage

KEV-listed: 20
With a forecast: 4,616
Unknown date: 0
Unscored severity: 631

Share of cohort: KEV 0.43% · forecast 100% · unscored 14%.

Showing 221–240 of 4,616By severity band: Critical · 9.0–10.0 331, High · 7.0–8.9 1,420, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 210, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 631

MedPublished 27 Feb 2026, 06:00 WIB

CVE-2026-28280

`osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query List

osctrl is an osquery management solution. Prior to version 0.5.0, a stored cross-site scripting (XSS) vulnerability exists in the `osctrl-admin` on-demand query list. A user with query-level permissions can inject arbitrary JavaScript via the query parameter when running an on-demand query. The payload is stored and ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T23:00:58.040Z. Updated 2026-03-02T20:42:03.824Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 03:42 WIB

Official record

HighPublished 27 Feb 2026, 05:59 WIB

CVE-2026-28279

`osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration

osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the `osctrl-admin` environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing environments. These commands are embedded…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 221 to 240 of 4616.First page Next page

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:59:29.972Z. Updated 2026-02-27T17:33:49.803Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:33 WIB

Official record

HighPublished 27 Feb 2026, 05:57 WIB

CVE-2026-28276

Initiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint

Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:57:36.406Z. Updated 2026-02-27T17:40:15.760Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:40 WIB

Official record

HighPublished 27 Feb 2026, 05:56 WIB

CVE-2026-28275

Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoints. This behavior a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:56:07.815Z. Updated 2026-02-27T17:44:23.728Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:44 WIB

Official record

HighPublished 27 Feb 2026, 05:55 WIB

CVE-2026-28274

Initiative Vulnerable to Token Theft via Stored XSS in Document Uploads

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives" section can upload a malicious `.html` or `.htm` file as a document. Be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:55:01.751Z. Updated 2026-02-27T17:48:34.045Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:48 WIB

Official record

MedPublished 27 Feb 2026, 05:52 WIB

CVE-2026-28269

Kiteworks Core has an OS Command Injection

Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:52:26.688Z. Updated 2026-02-27T17:53:05.993Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:53 WIB

Official record

MedPublished 27 Feb 2026, 05:49 WIB

CVE-2026-28230

In SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction)

SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId (a sequential integer starting from 1) without verifying that the requesting charger matches the charger that orig…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:49:33.613Z. Updated 2026-02-27T18:17:19.675Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:17 WIB

Official record

MedPublished 27 Feb 2026, 05:43 WIB

CVE-2026-28226

Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing

Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value direc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:43:05.629Z. Updated 2026-02-27T18:18:06.714Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:18 WIB

Official record

MedPublished 27 Feb 2026, 05:40 WIB

CVE-2026-28225

Manyfold has IDOR in ModelFilesController

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.1, the `get_model` method in `ModelFilesController` (line 158-160) loads models using `Model.find_param(params[:model_id])` without `policy_scope()`, bypassing Pund…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:40:17.996Z. Updated 2026-02-27T18:33:16.833Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:33 WIB

Official record

MedPublished 27 Feb 2026, 05:38 WIB

CVE-2026-28217

IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any au…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:38:33.854Z. Updated 2026-02-27T18:42:07.857Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:42 WIB

Official record

HighPublished 27 Feb 2026, 05:36 WIB

CVE-2026-28216

hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. `user-environments.resolver.ts:82-109`, `updateUserEnvironment` mutation uses `@UseGuards(GqlAuthGuard)` but is missing the `@GqlUser()` decorator e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:36:50.539Z. Updated 2026-02-27T18:43:16.218Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:43 WIB

Official record

CritPublished 27 Feb 2026, 05:34 WIB

CVE-2026-28215

hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by sending a single HTTP POST request with no authentication. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:34:46.524Z. Updated 2026-03-02T20:42:36.125Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 03:42 WIB

Official record

MedPublished 27 Feb 2026, 05:32 WIB

CVE-2026-3265

go2ismail Free-CRM Security API improper authorization

A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the file /api/Security/ of the component Security API. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly availab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:32:08.486Z. Updated 2026-02-27T18:49:54.918Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:49 WIB

Official record

CritPublished 27 Feb 2026, 05:31 WIB

CVE-2026-28213

EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response

EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:31:47.122Z. Updated 2026-02-27T18:51:10.647Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:51 WIB

Official record

HighPublished 27 Feb 2026, 05:29 WIB

CVE-2026-28211

Arbitrary code execution in log reader via untrusted log file

The NVDA Dev & Test Toolbox is an NVDA add-on for gathering tools to help NVDA development and testing. A vulnerability exists in versions 2.0 through 8.0 in the Log Reader feature of this add-on. A maliciously crafted log file can lead to arbitrary code execution when a user reads it with log reader commands. The log …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:29:36.164Z. Updated 2026-02-27T18:52:30.864Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:52 WIB

Official record

MedPublished 27 Feb 2026, 05:20 WIB

CVE-2026-28208

Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix

Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:20:03.765Z. Updated 2026-03-02T20:47:15.670Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 03:47 WIB

Official record

MedPublished 27 Feb 2026, 05:17 WIB

CVE-2026-28207

Zen-C Vulnerable to Command Injection via Malicious Output Filename

Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.2, a command injection vulnerability (CWE-78) in the Zen C compiler allows local attackers to execute arbitrary shell commands by providing a specially crafted output filename via the `-o` command-line argument. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:17:58.898Z. Updated 2026-03-02T20:48:09.055Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 03:48 WIB

Official record

MedPublished 27 Feb 2026, 05:14 WIB

CVE-2026-27638

ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoints (`/sync/*`) don't verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budget files by provi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:14:21.481Z. Updated 2026-03-02T20:48:53.277Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated03 Mar 2026, 03:48 WIB

Official record

MedPublished 27 Feb 2026, 05:07 WIB

CVE-2026-27839

wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup

wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.objects.get(pk=pk)` — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, incl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:07:43.640Z. Updated 2026-03-03T01:36:50.202Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 08:36 WIB

Official record

LowPublished 27 Feb 2026, 05:04 WIB

CVE-2026-27838

wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data

wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up to and including 2.4, ache keys are scoped only by `pk` — no user ID is included. When a victim has previously accessed their routine via the API, an attacker ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T22:04:57.968Z. Updated 2026-03-03T01:37:38.975Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 08:37 WIB

Official record