Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 2301–2320 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 18 Apr 2026, 01:48 WIB

CVE-2026-33337

Firebird has a buffer overflow when parsing corrupted slice packets

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T18:48:47.953Z. Updated 2026-04-17T19:21:17.132Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 02:21 WIB

Official record

MedPublished 18 Apr 2026, 01:41 WIB

CVE-2026-6437

AWS EFS CSI Driver Mount Option Injection

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2301 to 2320 of 5813.First page Next page

Published 2026-04-17T18:41:36.075Z. Updated 2026-10-20T18:20:23.843Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated21 Oct 2026, 01:20 WIB

Official record

HighPublished 18 Apr 2026, 01:38 WIB

CVE-2026-28224

Firebird Null Pointer Dereference via CryptCallback causes DOS

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T18:38:58.138Z. Updated 2026-04-17T19:31:38.952Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 02:31 WIB

Official record

MedPublished 18 Apr 2026, 01:35 WIB

CVE-2026-28214

Firebird server hangs when using specific clumplet on batch creation

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T18:35:46.974Z. Updated 2026-04-20T13:46:08.635Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:46 WIB

Official record

CritPublished 18 Apr 2026, 01:19 WIB

CVE-2026-40525

OpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPI

OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control fu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T18:19:12.315Z. Updated 2026-10-08T15:22:37.748Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

HighPublished 18 Apr 2026, 01:14 WIB

CVE-2026-27890

Firebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data Segments

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes segments arrive in strictly ascending order. If segments arrive out of order, the Array class's grow() method computes a n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T18:14:29.433Z. Updated 2026-04-17T18:50:22.134Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 01:50 WIB

Official record

HighPublished 18 Apr 2026, 01:05 WIB

CVE-2026-28212

Firebird has potential server crash via null pointer dereference when processing op_slice packet

Firebird is an open-source relational database management system. In versions prior to 6.0.0, 5.0.4, 4.0.7 and 3.0.14, when processing an op_slice network packet, the server passes an unprepared structure containing a null pointer to the SDL_info() function, resulting in a null pointer dereference and server crash. An …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T18:05:25.854Z. Updated 2026-04-20T13:46:08.904Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:46 WIB

Official record

HighPublished 18 Apr 2026, 00:47 WIB

CVE-2025-65104

Firebird: Information leak vulnerability in firebird3 client when used with newer server

Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.

Excerpt language: en.

Severity high: primary CNA CVSS 7.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T17:47:42.109Z. Updated 2026-04-17T18:25:11.941Z.

CVSS7.9v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 01:25 WIB

Official record

HighPublished 18 Apr 2026, 00:25 WIB

CVE-2026-5718

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.7. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T17:25:55.466Z. Updated 2026-05-27T00:26:11.453Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 07:26 WIB

Official record

HighPublished 18 Apr 2026, 00:25 WIB

CVE-2026-5710

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read in versions up to and including 1.3.9.6. This is due to the plugin using client-supplied mfile[] POST values as the source of truth for email attachment selection without perform…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T17:25:54.940Z. Updated 2026-04-17T17:50:00.362Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 00:50 WIB

Official record

MedPublished 18 Apr 2026, 00:25 WIB

CVE-2026-40320

Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck

Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T17:25:50.449Z. Updated 2026-04-20T13:46:09.036Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:46 WIB

Official record

LowPublished 18 Apr 2026, 00:16 WIB

CVE-2026-40319

Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check

Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMatching check passes a user-supplied regular expression pattern directly to Python's re.search() without any timeout or complexity guard. A crafted regex pattern can trigger catastrophic backtracking, causing the process …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T17:16:37.676Z. Updated 2026-04-20T13:46:09.167Z.

CVSS1v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 20:46 WIB

Official record

HighPublished 17 Apr 2026, 23:43 WIB

CVE-2026-40518

ByteDance DeerFlow Path Traversal and Arbitrary File Write via Bootstrap Mode

ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent creation where the agent name validation is bypassed. Attackers can supply traversal-style values or absolute paths as the agent name to influence directory creation and write files o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T16:43:42.387Z. Updated 2026-08-14T16:49:50.704Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record

HighPublished 17 Apr 2026, 23:26 WIB

CVE-2026-3464

WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file

The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajax_attach_file' function in all versions up to, and including, 8.3.4. This makes it possible for authenticated attackers with a role that an administrator grants access to (e.g.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T16:26:50.576Z. Updated 2026-04-17T18:37:36.472Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 01:37 WIB

Official record

UnscoredPublished 17 Apr 2026, 23:08 WIB

CVE-2026-21733

GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files. This is caused by improper handling of GPU memory reservation protections.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T16:08:25.661Z. Updated 2026-06-26T15:07:33.429Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Jun 2026, 22:07 WIB

Official record

HighPublished 17 Apr 2026, 23:02 WIB

CVE-2026-40516

OpenHarness SSRF via web_fetch and web_search

OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. Attackers can influence an agent session to invo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T16:02:09.082Z. Updated 2026-07-14T20:00:30.592Z.

CVSS7.8v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 03:00 WIB

Official record

HighPublished 17 Apr 2026, 23:00 WIB

CVE-2026-40515

OpenHarness Permission Bypass via grep and glob root argument

OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tools with sensitive root directories that are not properly evaluated against …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T16:00:07.116Z. Updated 2026-07-14T20:00:29.877Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 03:00 WIB

Official record

UnscoredPublished 17 Apr 2026, 22:32 WIB

CVE-2026-21709

CVE-2026-21709

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T15:32:10.755Z. Updated 2026-04-20T14:06:52.636Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:06 WIB

Official record

MedPublished 17 Apr 2026, 22:30 WIB

CVE-2026-6497

prasathmani TinyFileManager File Upload filemanager.php server-side request forgery

A vulnerability was determined in prasathmani TinyFileManager up to 2.6. Affected by this vulnerability is an unknown functionality of the file /filemanager.php?p= ajax=true&type=upload of the component File Upload Handler. This manipulation of the argument uploadurl causes server-side request forgery. It is possible t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T15:30:12.319Z. Updated 2026-04-17T18:39:49.310Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 01:39 WIB

Official record

CritPublished 17 Apr 2026, 22:14 WIB

CVE-2026-6284

Horner Automation Cscape and XL4, XL7 PLC Weak password requirements

An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T15:14:06.346Z. Updated 2026-04-20T14:58:32.621Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:58 WIB

Official record