Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 221–240 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 30 Apr 2026, 00:43 WIB

CVE-2026-26204

Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertData

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T17:43:44.911Z. Updated 2026-04-30T12:48:18.639Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated30 Apr 2026, 19:48 WIB

Official record

CritPublished 30 Apr 2026, 00:37 WIB

CVE-2026-26015

Unauthenticated RCE in DocsGPT MCP STDIO Configuration

DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution (RCE). This issue has been…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 221 to 240 of 5813.First page Next page

Published 2026-04-29T17:37:25.524Z. Updated 2026-05-06T19:43:48.147Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated07 May 2026, 02:43 WIB

Official record

MedPublished 30 Apr 2026, 00:30 WIB

CVE-2026-7396

NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal

A vulnerability was identified in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/wecom.py of the component WeChat Work Platform Adapter. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T17:30:15.387Z. Updated 2026-04-29T19:28:34.807Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 02:28 WIB

Official record

HighPublished 30 Apr 2026, 00:18 WIB

CVE-2026-5712

IdentityIQ Role Editor Incorrect Authorization Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.

Excerpt language: en.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T17:18:27.748Z. Updated 2026-04-30T03:56:06.567Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated30 Apr 2026, 10:56 WIB

Official record

MedPublished 30 Apr 2026, 00:15 WIB

CVE-2026-7394

SourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injection

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/view_order.php of the component GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T17:15:11.992Z. Updated 2026-04-29T18:31:55.135Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 01:31 WIB

Official record

MedPublished 30 Apr 2026, 00:00 WIB

CVE-2026-7393

SourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload

A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function save_menu of the file /admin/admin_class_novo.php of the component File Extension Handler. Performing a manipulation of the argument img results in unrestricted upload. The attack is possible to be carried out remotely. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T17:00:16.996Z. Updated 2026-04-29T17:39:13.325Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 00:39 WIB

Official record

MedPublished 29 Apr 2026, 23:51 WIB

CVE-2026-6915

Flaw in the updateUser Command May Allow Unauthorized Configuration Change

An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T16:51:01.903Z. Updated 2026-04-29T17:49:18.851Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 00:49 WIB

Official record

HighPublished 29 Apr 2026, 23:47 WIB

CVE-2026-6914

MD5 checksum creation may cause availability loss

Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T16:47:02.056Z. Updated 2026-04-29T17:49:48.034Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 00:49 WIB

Official record

MedPublished 29 Apr 2026, 23:45 WIB

CVE-2026-7392

SourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier sql injection

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function delete_supplier of the file /ajax.php?action=delete_supplier. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T16:45:09.759Z. Updated 2026-04-29T18:14:29.466Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 01:14 WIB

Official record

UnscoredPublished 29 Apr 2026, 23:21 WIB

CVE-2026-0206

CVE-2026-0206

A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T16:21:40.001Z. Updated 2026-04-29T17:00:31.592Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Apr 2026, 00:00 WIB

Official record

UnscoredPublished 29 Apr 2026, 23:18 WIB

CVE-2026-0205

CVE-2026-0205

A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T16:18:45.856Z. Updated 2026-04-29T16:59:41.635Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Apr 2026, 23:59 WIB

Official record

UnscoredPublished 29 Apr 2026, 23:15 WIB

CVE-2026-0204

CVE-2026-0204

A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T16:15:32.039Z. Updated 2026-04-30T03:55:59.264Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Apr 2026, 10:55 WIB

Official record

MedPublished 29 Apr 2026, 23:15 WIB

CVE-2026-7391

SourceCodester Pharmacy Sales and Inventory System ajax.php save_supplier sql injection

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier of the file /ajax.php?action=save_supplier. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T16:15:12.615Z. Updated 2026-04-30T13:01:14.495Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 20:01 WIB

Official record

HighPublished 29 Apr 2026, 22:58 WIB

CVE-2026-42198

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T15:58:49.174Z. Updated 2026-09-11T12:09:08.316Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated11 Sep 2026, 19:09 WIB

Official record

MedPublished 29 Apr 2026, 22:45 WIB

CVE-2026-7390

SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function Customer of the file /index.php?page=customer. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T15:45:11.636Z. Updated 2026-04-29T17:11:49.240Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 00:11 WIB

Official record

MedPublished 29 Apr 2026, 22:39 WIB

CVE-2026-40230

Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering

Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor privileges can persist arbitrary HTML or JavaScript in the body field of a knowledge base Doc.This issue affects helpy: 2.8.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T15:39:09.093Z. Updated 2026-04-29T16:20:34.028Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 23:20 WIB

Official record

MedPublished 29 Apr 2026, 22:34 WIB

CVE-2026-40229

Helpy 2.8.0 - Stored XSS in post author display via PostsHelper

Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML notification emails sent to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T15:34:50.094Z. Updated 2026-04-29T16:20:14.057Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 23:20 WIB

Official record

MedPublished 29 Apr 2026, 22:30 WIB

CVE-2026-7389

EyouCMS common.php GetSortData sql injection

A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The manipulation of the argument sort_asc leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The pro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T15:30:18.641Z. Updated 2026-04-29T16:19:40.411Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 23:19 WIB

Official record

MedPublished 29 Apr 2026, 22:23 WIB

CVE-2026-2810

Endpoint DLP Driver Out-of-Bounds Read

Netskope was notified about a potential gap in the Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an out-of-bounds read within a driver, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would requi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T15:23:11.592Z. Updated 2026-04-29T16:19:01.503Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 23:19 WIB

Official record

MedPublished 29 Apr 2026, 22:15 WIB

CVE-2026-7388

EyouCMS Template File FilemanagerLogic.php editFile code injection

A weakness has been identified in EyouCMS up to 1.7.9. Impacted is the function editFile of the file application/admin/logic/FilemanagerLogic.php of the component Template File Handler. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has been made available to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T15:15:16.230Z. Updated 2026-04-29T18:32:10.189Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 01:32 WIB

Official record