Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 221–240 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 31 Aug 2026, 14:40 WIB

CVE-2026-58301

Apache Shiro: Server-side POST request may be steered to an alternate host

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T07:40:37.337Z. Updated 2026-08-31T15:29:49.700Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:29 WIB

Official record

MedPublished 31 Aug 2026, 14:30 WIB

CVE-2026-82630

PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 221 to 240 of 12259.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T07:30:09.118Z. Updated 2026-08-31T15:00:40.791Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:00 WIB

Official record

MedPublished 31 Aug 2026, 14:15 WIB

CVE-2026-82629

jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload

A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.doUpload of the file jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java of the component doUpload Endpoint. Executing a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T07:15:08.902Z. Updated 2026-08-31T22:03:32.828Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 05:03 WIB

Official record

CritPublished 31 Aug 2026, 14:00 WIB

CVE-2026-82628

Colorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management

A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component IOCTL Dispatch. Performing a manipulation of the argument PhysicalAddress/AlignNumer/AlignSize results in improper privilege management. Attacking locally is a re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T07:00:08.968Z. Updated 2026-08-31T14:34:57.895Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:34 WIB

Official record

MedPublished 31 Aug 2026, 13:45 WIB

CVE-2026-82625

code-projects Simple Inventory System User Registration register.php cross site scripting

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument last_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:45:07.964Z. Updated 2026-09-01T14:57:08.444Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:57 WIB

Official record

UnscoredPublished 31 Aug 2026, 13:37 WIB

CVE-2026-40465

An Open Re-direct Vulnerability in Nokia NSP

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:37:19.360Z. Updated 2026-08-31T15:33:24.299Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:33 WIB

Official record

UnscoredPublished 31 Aug 2026, 13:35 WIB

CVE-2026-40464

A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP

NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:35:32.425Z. Updated 2026-08-31T14:33:52.270Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:33 WIB

Official record

UnscoredPublished 31 Aug 2026, 13:32 WIB

CVE-2026-40463

An Insufficient Role-based Access Control Vulnerability in WaveSuite

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:32:25.491Z. Updated 2026-08-31T15:36:24.517Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:36 WIB

Official record

MedPublished 31 Aug 2026, 13:31 WIB

CVE-2026-53620

CVE-2026-53620

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:31:32.162Z. Updated 2026-08-31T15:37:03.336Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:37 WIB

Official record

MedPublished 31 Aug 2026, 13:31 WIB

CVE-2026-68951

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:31:18.545Z. Updated 2026-08-31T15:37:36.726Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:37 WIB

Official record

MedPublished 31 Aug 2026, 13:30 WIB

CVE-2026-82624

code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publishe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:30:09.424Z. Updated 2026-08-31T15:44:39.287Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:44 WIB

Official record

CritPublished 31 Aug 2026, 13:28 WIB

CVE-2026-58574

CVE-2026-58574

Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a Critical vulnerability a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:28:45.931Z. Updated 2026-08-31T14:33:06.554Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:33 WIB

Official record

MedPublished 31 Aug 2026, 13:15 WIB

CVE-2026-82623

open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free

A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backend_copyRange of the file plugins/historydata/ua_history_data_backend_memory.c of the component History Backend. The manipulation results in use after free. The attack can be launched remotely. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:15:08.682Z. Updated 2026-08-31T16:24:19.013Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:24 WIB

Official record

UnscoredPublished 31 Aug 2026, 13:00 WIB

CVE-2026-77013

Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:00:17.458Z. Updated 2026-08-31T12:38:05.781Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Aug 2026, 19:38 WIB

Official record

MedPublished 31 Aug 2026, 13:00 WIB

CVE-2026-82622

code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting

A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/editaction.php of the component Employee Profile Update. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T06:00:12.294Z. Updated 2026-08-31T22:03:38.952Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 05:03 WIB

Official record

MedPublished 31 Aug 2026, 12:45 WIB

CVE-2026-82621

Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization

A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T05:45:09.136Z. Updated 2026-08-31T14:32:31.693Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:32 WIB

Official record

MedPublished 31 Aug 2026, 12:30 WIB

CVE-2026-82620

Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking sql injection

A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.course_ranking of the file code/src/dao/CourseDao.java. Performing a manipulation of the argument cno results in sql injection. It is possible to initiate the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T05:30:08.729Z. Updated 2026-09-01T14:55:38.585Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:55 WIB

Official record

MedPublished 31 Aug 2026, 12:15 WIB

CVE-2026-82619

Systerel S2OPC subscription_mgr.c use after free

A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitored_item_event_filter_treatment_bs__init_event_filter_ctx_and_result of the file src/ClientServer/services/bgenc/subscription_mgr.c. Such manipulation of the argument EventFilter leads to use after free. The attack …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T05:15:10.327Z. Updated 2026-08-31T15:45:39.444Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:45 WIB

Official record

MedPublished 31 Aug 2026, 12:00 WIB

CVE-2026-82618

Systerel S2OPC String Array Range Writing sopc_builtintypes.c set_range_matrix_on_string_array out-of-bounds

A vulnerability was determined in Systerel S2OPC up to 1.7.3. The affected element is the function set_range_matrix_on_string_array of the file src/Common/opcua_types/sopc_builtintypes.c of the component String Array Range Writing. This manipulation causes out-of-bounds read. The attack is possible to be carried out re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T05:00:11.801Z. Updated 2026-08-31T16:26:51.249Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:26 WIB

Official record

CritPublished 31 Aug 2026, 11:45 WIB

CVE-2026-82616

TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T04:45:11.952Z. Updated 2026-09-01T18:11:10.152Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 01:11 WIB

Official record