Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2241–2260 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

LowPublished 26 Oct 2026, 20:48 WIB

CVE-2026-112880

CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:48:46.589Z. Updated 2026-10-26T15:35:50.632Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

MedPublished 26 Oct 2026, 20:45 WIB

CVE-2026-116283

Kameleo Local API profiles information disclosure

A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2241 to 2260 of 16156.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:45:21.554Z. Updated 2026-10-26T13:45:21.554Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:45 WIB

Official record

CritPublished 26 Oct 2026, 20:45 WIB

CVE-2026-107656

CVE-2026-107656

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to exe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:45:03.962Z. Updated 2026-10-27T06:54:55.555Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 13:54 WIB

Official record

UnscoredPublished 26 Oct 2026, 20:39 WIB

CVE-2026-111590

SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. Whe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:39:48.420Z. Updated 2026-10-26T13:39:48.420Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:39 WIB

Official record

HighPublished 26 Oct 2026, 20:35 WIB

CVE-2026-108529

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:35:26.080Z. Updated 2026-10-26T15:35:50.781Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

CritPublished 26 Oct 2026, 20:33 WIB

CVE-2026-59107

Shared SSH Authentication Key in vSolution Matrix File Sharing

A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:33:12.851Z. Updated 2026-10-26T13:33:12.851Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:33 WIB

Official record

HighPublished 26 Oct 2026, 20:32 WIB

CVE-2026-110499

Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:32:38.613Z. Updated 2026-10-26T15:35:50.929Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

HighPublished 26 Oct 2026, 20:32 WIB

CVE-2026-109584

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then referen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:32:22.359Z. Updated 2026-10-26T15:35:51.081Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

HighPublished 26 Oct 2026, 20:32 WIB

CVE-2026-111103

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError partway through a chunk, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:32:06.340Z. Updated 2026-10-26T15:35:51.229Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

HighPublished 26 Oct 2026, 20:31 WIB

CVE-2026-111101

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its ow…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:31:48.184Z. Updated 2026-10-26T15:35:51.401Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

HighPublished 26 Oct 2026, 20:31 WIB

CVE-2026-113436

Quadratic bignum parsing of Content-Length and Host port values in Bandit

Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:31:35.033Z. Updated 2026-10-26T15:35:51.556Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

MedPublished 26 Oct 2026, 20:31 WIB

CVE-2026-110314

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:31:18.257Z. Updated 2026-10-26T13:31:18.257Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:31 WIB

Official record

HighPublished 26 Oct 2026, 20:30 WIB

CVE-2026-114213

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames. Bandit.WebSocket.Connection checks max_fragmented_message_size a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:30:58.262Z. Updated 2026-10-26T15:35:51.785Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

MedPublished 26 Oct 2026, 20:30 WIB

CVE-2026-114216

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/band…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:30:41.225Z. Updated 2026-10-26T15:35:51.933Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

HighPublished 26 Oct 2026, 20:30 WIB

CVE-2026-115269

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body. Bandit.HTTP2.Stream.do_read_da…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:30:24.621Z. Updated 2026-10-26T15:35:52.079Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

HighPublished 26 Oct 2026, 20:29 WIB

CVE-2026-108525

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:29:42.520Z. Updated 2026-10-26T15:35:52.227Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

MedPublished 26 Oct 2026, 20:15 WIB

CVE-2026-116282

Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure

A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:15:17.127Z. Updated 2026-10-26T16:15:47.691Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:15 WIB

Official record

CritPublished 26 Oct 2026, 20:15 WIB

CVE-2026-59106

Unauthenticated RCE Vulnerability in WolfProt interface implementation

A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:15:02.436Z. Updated 2026-10-26T15:35:52.374Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:35 WIB

Official record

HighPublished 26 Oct 2026, 20:08 WIB

CVE-2026-116488

NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:08:53.415Z. Updated 2026-10-26T13:08:53.415Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:08 WIB

Official record

MedPublished 26 Oct 2026, 20:08 WIB

CVE-2026-116487

NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T13:08:52.737Z. Updated 2026-10-26T13:08:52.737Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:08 WIB

Official record