Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 2281–2300 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 18 Apr 2026, 02:58 WIB

CVE-2026-32624

xrdp: Heap buffer overflow in xrdp_sec_process_logon_info() via incorrect g_strncat length calculation

xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in its logon processing. In environments where domain_user_separator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain name to overflow the i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:58:08.687Z. Updated 2026-04-20T16:22:13.525Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 23:22 WIB

Official record

HighPublished 18 Apr 2026, 02:56 WIB

CVE-2026-33516

xrdp: Pre-authentication out-of-bounds reads in RDP capability and channel parsers

xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occurs when memory is accessed before validating the remaining buffer length. A remote, unauthenticated attacker can trigger this vulnerability by sending a speciall…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2281 to 2300 of 5813.First page Next page

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:56:11.990Z. Updated 2026-04-20T15:43:53.801Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 22:43 WIB

Official record

HighPublished 18 Apr 2026, 02:52 WIB

CVE-2026-32650

Anviz CrossChex Standard Algorithm Downgrade

Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials to be sent in plaintext and enabling unauthorized database access.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:52:45.308Z. Updated 2026-04-17T20:26:17.922Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 03:26 WIB

Official record

HighPublished 18 Apr 2026, 02:49 WIB

CVE-2026-40434

Anviz CrossChex Standard Improper Verification of Source of a Communication Channel

Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:49:28.099Z. Updated 2026-04-17T20:28:02.785Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 03:28 WIB

Official record

HighPublished 18 Apr 2026, 02:46 WIB

CVE-2026-35682

Anviz CX2 Lite Command Injection

Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g., starting telnetd), resulting in root‑level access.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:46:26.716Z. Updated 2026-04-17T20:30:18.510Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 03:30 WIB

Official record

HighPublished 18 Apr 2026, 02:43 WIB

CVE-2026-32623

xrdp: Heap buffer overflow in NeutrinoRDP channel reassembly

xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its allocated memory buff…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:43:58.682Z. Updated 2026-04-22T03:55:35.336Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated22 Apr 2026, 10:55 WIB

Official record

HighPublished 18 Apr 2026, 02:43 WIB

CVE-2026-40066

Anviz Products Download of Code Without Integrity Check

Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:43:20.709Z. Updated 2026-07-10T22:37:11.001Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated11 Jul 2026, 05:37 WIB

Official record

CritPublished 18 Apr 2026, 02:39 WIB

CVE-2026-35546

Anviz Products Missing Authentication for Critical Function

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted, enabling attackers to plant and execute code and obtain a reverse shell.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:39:25.110Z. Updated 2026-04-17T20:05:28.411Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 03:05 WIB

Official record

HighPublished 18 Apr 2026, 02:36 WIB

CVE-2026-40461

Anviz Products Missing Authentication for Critical Function

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:36:29.842Z. Updated 2026-04-17T20:03:18.872Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 03:03 WIB

Official record

MedPublished 18 Apr 2026, 02:34 WIB

CVE-2026-32648

Anviz Products Missing Authorization

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in reconnaissance against the device.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:34:21.522Z. Updated 2026-04-17T20:09:05.861Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 03:09 WIB

Official record

MedPublished 18 Apr 2026, 02:30 WIB

CVE-2026-33569

Anviz Products Cleartext Transmission of Sensitive Information

Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:30:46.066Z. Updated 2026-04-17T20:32:48.104Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 03:32 WIB

Official record

CritPublished 18 Apr 2026, 02:27 WIB

CVE-2026-32105

xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode

xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implement…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:27:39.809Z. Updated 2026-04-20T16:22:50.262Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 23:22 WIB

Official record

HighPublished 18 Apr 2026, 02:25 WIB

CVE-2026-32107

xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails

xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An ad…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:25:20.274Z. Updated 2026-04-22T03:55:34.190Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 10:55 WIB

Official record

MedPublished 18 Apr 2026, 02:24 WIB

CVE-2026-31927

Anviz CX7 Firmware Relative Path Traversal

Anviz CX7 Firmware is vulnerable to an authenticated CSV upload which allows path traversal to overwrite arbitrary files (e.g., /etc/shadow), enabling unauthorized SSH access when combined with debug‑setting changes.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:24:53.893Z. Updated 2026-07-10T22:35:14.120Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated11 Jul 2026, 05:35 WIB

Official record

CritPublished 18 Apr 2026, 02:22 WIB

CVE-2026-40342

Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:22:46.644Z. Updated 2026-04-22T13:56:49.927Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 20:56 WIB

Official record

HighPublished 18 Apr 2026, 02:22 WIB

CVE-2026-32324

Anviz CX7 Firmware Use of Hard-coded Cryptographic Key

Anviz CX7 Firmware is vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scale.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:22:12.097Z. Updated 2026-04-17T20:10:48.189Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 03:10 WIB

Official record

MedPublished 18 Apr 2026, 02:19 WIB

CVE-2026-35061

Anviz Products Missing Authorization

Anviz CX7 Firmware is vulnerable to the most recently captured test photo that can be retrieved without authentication, revealing sensitive operational imagery.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:19:25.884Z. Updated 2026-04-17T20:07:00.826Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 03:07 WIB

Official record

MedPublished 18 Apr 2026, 02:17 WIB

CVE-2026-33093

Anviz Products Missing Authorization

Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T19:17:15.274Z. Updated 2026-04-17T19:54:36.104Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 02:54 WIB

Official record

HighPublished 18 Apr 2026, 01:59 WIB

CVE-2026-35215

Firebird: DoS via malicious slice descriptor in slice packet

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causing a division by zero.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T18:59:23.663Z. Updated 2026-04-20T15:40:39.510Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Apr 2026, 22:40 WIB

Official record

HighPublished 18 Apr 2026, 01:52 WIB

CVE-2026-34232

Firebird: DoS via `op_response` packet from client

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr_status_vector() function does not handle the isc_arg_cstring type when decoding an op_response packet, causing a server crash when one is encountered in the status vector. An unauthenticated attacker …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T18:52:11.693Z. Updated 2026-04-20T13:46:08.507Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:46 WIB

Official record