Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2221–2240 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 26 Oct 2026, 21:43 WIB

CVE-2026-112345

TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent sessi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:43:29.943Z. Updated 2026-10-27T10:14:05.557Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

MedPublished 26 Oct 2026, 21:41 WIB

CVE-2026-3322

Privilege escalation via request replaying in Lobster_pro

Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2221 to 2240 of 16156.First page Next page

Published 2026-10-26T14:41:12.655Z. Updated 2026-10-27T08:11:20.312Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 15:11 WIB

Official record

UnscoredPublished 26 Oct 2026, 21:40 WIB

CVE-2026-110748

Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some specific formats and the re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:40:39.690Z. Updated 2026-10-26T14:40:39.690Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:40 WIB

Official record

MedPublished 26 Oct 2026, 21:35 WIB

CVE-2026-92171

Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store

A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are store…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:35:11.009Z. Updated 2026-10-26T14:35:11.009Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:35 WIB

Official record

MedPublished 26 Oct 2026, 21:31 WIB

CVE-2026-116497

Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix so…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:31:23.205Z. Updated 2026-10-26T17:57:34.509Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:57 WIB

Official record

MedPublished 26 Oct 2026, 21:30 WIB

CVE-2026-116339

iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been publicly disclosed an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:30:18.662Z. Updated 2026-10-26T16:15:37.067Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:15 WIB

Official record

LowPublished 26 Oct 2026, 21:28 WIB

CVE-2026-93848

Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator

Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch..…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:28:23.565Z. Updated 2026-10-26T16:46:45.446Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:46 WIB

Official record

MedPublished 26 Oct 2026, 21:26 WIB

CVE-2026-93850

Unbounded memory consumption during PDF text extraction

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very lar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:26:56.502Z. Updated 2026-10-26T16:46:45.587Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:46 WIB

Official record

MedPublished 26 Oct 2026, 21:25 WIB

CVE-2026-93849

Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSoc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:25:26.554Z. Updated 2026-10-26T16:46:45.736Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:46 WIB

Official record

CritPublished 26 Oct 2026, 21:24 WIB

CVE-2026-93328

Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted too…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:24:09.012Z. Updated 2026-10-26T16:46:45.879Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:46 WIB

Official record

UnscoredPublished 26 Oct 2026, 21:15 WIB

CVE-2026-110733

Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:15:55.097Z. Updated 2026-10-26T16:29:01.382Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:29 WIB

Official record

LowPublished 26 Oct 2026, 21:15 WIB

CVE-2026-93847

Improper post type validation on scheduled post endpoints

Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:15:12.711Z. Updated 2026-10-26T14:15:12.711Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:15 WIB

Official record

CritPublished 26 Oct 2026, 21:07 WIB

CVE-2026-65184

Avocent ACS8000 wsserver command injection

The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:07:08.235Z. Updated 2026-10-26T16:46:46.017Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:46 WIB

Official record

HighPublished 26 Oct 2026, 21:02 WIB

CVE-2026-115930

MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs

The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:02:51.248Z. Updated 2026-10-26T14:02:51.248Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:02 WIB

Official record

MedPublished 26 Oct 2026, 21:00 WIB

CVE-2026-116284

Kameleo Local API user-info information disclosure

A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T14:00:21.191Z. Updated 2026-10-26T14:00:21.191Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:00 WIB

Official record

MedPublished 26 Oct 2026, 20:56 WIB

CVE-2026-116516

Insufficient length validation when parsing Zoom chat transcriptions

Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:56:57.973Z. Updated 2026-10-26T15:35:50.283Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

HighPublished 26 Oct 2026, 20:49 WIB

CVE-2026-97200

Unbounded response body buffering and decompression in hackney

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connecti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:49:40.392Z. Updated 2026-10-26T15:35:50.487Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

CritPublished 26 Oct 2026, 20:49 WIB

CVE-2026-115693

Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:49:29.374Z. Updated 2026-10-26T13:49:29.374Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:49 WIB

Official record

MedPublished 26 Oct 2026, 20:49 WIB

CVE-2026-113440

HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:49:17.377Z. Updated 2026-10-26T13:49:17.377Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:49 WIB

Official record

MedPublished 26 Oct 2026, 20:49 WIB

CVE-2026-115700

SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D (decoding to [::ffff:127.0.0.1]) or 127.0.0.1. is not an IP address to a caller'…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:49:02.744Z. Updated 2026-10-26T13:49:02.744Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:49 WIB

Official record