Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 2321–2340 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 17 Apr 2026, 21:30 WIB

CVE-2026-6496

prasathmani TinyFileManager POST Parameter filemanager.php path traversal

A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /filemanager.php of the component POST Parameter Handler. The manipulation of the argument file[] results in path traversal. The attack may be performed from remote. The exploit has been made public and could…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T14:30:12.997Z. Updated 2026-04-17T16:35:16.121Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 23:35 WIB

Official record

MedPublished 17 Apr 2026, 21:29 WIB

CVE-2026-41153

CVE-2026-41153

In JetBrains Junie before 252.549.29 command execution was possible via malicious project file

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T14:29:04.503Z. Updated 2026-04-20T14:58:41.237Z.

Showing 2321 to 2340 of 5813.First page Next page

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:58 WIB

Official record

MedPublished 17 Apr 2026, 21:15 WIB

CVE-2026-6493

lukevella rallly Reset Password reset-password-form.tsx cross site scripting

A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site scripting. The attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T14:15:15.422Z. Updated 2026-04-20T14:58:49.011Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:58 WIB

Official record

MedPublished 17 Apr 2026, 21:00 WIB

CVE-2026-6492

arnobt78 Hotel Booking Management System Health Check Endpoint detailed information disclosure

A vulnerability was detected in arnobt78 Hotel Booking Management System up to f8922d0e0f6ac1cc761974c7616f44c2bbc04bea. The impacted element is an unknown function of the file /api/health/detailed of the component Health Check Endpoint. Performing a manipulation results in information disclosure. Remote exploitation o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T14:00:15.221Z. Updated 2026-08-02T10:40:58.600Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Aug 2026, 17:40 WIB

Official record

MedPublished 17 Apr 2026, 20:45 WIB

CVE-2026-6491

libvips nip2 vips7compat.c im_minpos_vec heap-based overflow

A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T13:45:11.506Z. Updated 2026-04-18T02:59:14.319Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:59 WIB

Official record

HighPublished 17 Apr 2026, 20:18 WIB

CVE-2026-40459

LDAP Injection in PAC4J

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T13:18:39.181Z. Updated 2026-04-17T13:54:22.069Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 20:54 WIB

Official record

HighPublished 17 Apr 2026, 20:18 WIB

CVE-2026-40458

Cross-Site Request Forgery in PAC4J

PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the attacker does not need to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T13:18:26.308Z. Updated 2026-04-17T14:00:04.811Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 21:00 WIB

Official record

MedPublished 17 Apr 2026, 20:15 WIB

CVE-2026-6490

QueryMine sms GET Request Parameter deletecourse.php sql injection

A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. Impacted is an unknown function of the file admin/deletecourse.php of the component GET Request Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T13:15:11.136Z. Updated 2026-04-17T14:04:14.886Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 21:04 WIB

Official record

MedPublished 17 Apr 2026, 20:00 WIB

CVE-2026-6489

QueryMine sms Background Management addteacher.php unrestricted upload

A security flaw has been discovered in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This issue affects some unknown processing of the file admin/addteacher.php of the component Background Management Page. The manipulation of the argument image results in unrestricted upload. The attack can be launched …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T13:00:21.493Z. Updated 2026-04-17T16:36:28.077Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 23:36 WIB

Official record

MedPublished 17 Apr 2026, 19:45 WIB

CVE-2026-6488

QueryMine sms GET Request Parameter editcourse.php sql injection

A vulnerability was identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This vulnerability affects unknown code of the file admin/editcourse.php of the component GET Request Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T12:45:11.275Z. Updated 2026-04-20T14:58:56.910Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:58 WIB

Official record

MedPublished 17 Apr 2026, 19:30 WIB

CVE-2026-6487

Qihui jtbc5 CMS Code Endpoint manage.php path traversal

A flaw has been found in Qihui jtbc5 CMS 5.0.3.6. Affected is an unknown function of the file /dev/code/common/diplomat/manage.php of the component Code Endpoint. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T12:30:39.824Z. Updated 2026-04-17T13:18:00.383Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 20:18 WIB

Official record

HighPublished 17 Apr 2026, 19:23 WIB

CVE-2026-6507

Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the `--dhcp-split-relay` option. This can lead to memory corruption, causing the dnsmasq daemon to crash and re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T12:23:31.852Z. Updated 2026-09-01T11:45:02.240Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 18:45 WIB

Official record

MedPublished 17 Apr 2026, 19:15 WIB

CVE-2026-6486

classroombookings User Display Name layout.php read cross site scripting

A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed remotely. The exploit is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T12:15:14.036Z. Updated 2026-04-18T02:58:17.041Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:58 WIB

Official record

MedPublished 17 Apr 2026, 18:52 WIB

CVE-2026-23777

CVE-2026-23777

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an exposure of sensitive information to an unauthorized actor vulnerability. A low privi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T11:52:13.427Z. Updated 2026-04-17T13:14:12.461Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated17 Apr 2026, 20:14 WIB

Official record

MedPublished 17 Apr 2026, 18:44 WIB

CVE-2026-28263

CVE-2026-28263

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access coul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T11:44:12.943Z. Updated 2026-04-18T02:57:02.616Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 09:57 WIB

Official record

MedPublished 17 Apr 2026, 18:36 WIB

CVE-2025-46606

CVE-2025-46606

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper restriction of excessive authentication attempts vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized acce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T11:36:54.469Z. Updated 2026-04-18T03:55:33.318Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 10:55 WIB

Official record

MedPublished 17 Apr 2026, 18:27 WIB

CVE-2025-46605

CVE-2025-46605

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain a session fixation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T11:27:24.378Z. Updated 2026-04-20T14:06:10.099Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated20 Apr 2026, 21:06 WIB

Official record

MedPublished 17 Apr 2026, 18:19 WIB

CVE-2025-46641

CVE-2025-46641

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper authentication vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T11:19:52.871Z. Updated 2026-04-18T03:55:34.970Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 10:55 WIB

Official record

MedPublished 17 Apr 2026, 18:13 WIB

CVE-2025-46607

CVE-2025-46607

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper authentication vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T11:13:08.869Z. Updated 2026-04-18T03:55:37.071Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated18 Apr 2026, 10:55 WIB

Official record

MedPublished 17 Apr 2026, 18:05 WIB

CVE-2026-35073

CVE-2026-35073

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-17T11:05:38.442Z. Updated 2026-10-14T14:14:07.944Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated14 Oct 2026, 21:14 WIB

Official record