Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 2381–2400 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79784

Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class_path value from the configuration, splits it into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:12.456Z. Updated 2026-09-24T14:19:42.300Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

LowPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79783

rclone before 1.74.4 Privilege Escalation via setuid Metadata

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates pri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2381 to 2400 of 12259.First page Next page

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:11.806Z. Updated 2026-08-25T16:11:49.885Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:11 WIB

Official record

CritPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79782

rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:11.136Z. Updated 2026-08-28T22:26:44.440Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:26 WIB

Official record

MedPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79781

rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:10.471Z. Updated 2026-08-25T17:29:20.262Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:29 WIB

Official record

MedPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79780

rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:09.789Z. Updated 2026-08-25T16:07:21.266Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:07 WIB

Official record

MedPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79779

rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:09.110Z. Updated 2026-08-27T16:45:55.566Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:45 WIB

Official record

MedPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79778

rclone before v1.75.0 Denial of Service via TUS nil-response panic

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:08.402Z. Updated 2026-08-25T16:12:58.686Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:12 WIB

Official record

MedPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79777

rclone before v1.75.0 Information Disclosure via RC API

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:07.745Z. Updated 2026-08-28T22:25:36.423Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:25 WIB

Official record

MedPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79776

rclone before 1.75.0 Authentication Bypass via pprof

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:07.085Z. Updated 2026-08-25T17:27:57.096Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:27 WIB

Official record

HighPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79775

rclone Archive Backend SquashFS Parser Denial of Service

rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker wh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:06.427Z. Updated 2026-08-29T11:48:01.347Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:48 WIB

Official record

CritPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79774

Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:05.738Z. Updated 2026-10-08T15:25:16.318Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

MedPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79773

Winter CMS before 1.2.13 Local File Inclusion via JavaScript

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:05.053Z. Updated 2026-10-08T15:25:15.270Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

MedPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79772

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:04.400Z. Updated 2026-08-28T22:24:47.141Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 05:24 WIB

Official record

MedPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79771

Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service again…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:03.736Z. Updated 2026-08-25T17:44:08.629Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:44 WIB

Official record

HighPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79770

Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:03.059Z. Updated 2026-09-16T15:51:27.061Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated16 Sep 2026, 22:51 WIB

Official record

HighPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79769

Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argum…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:02.372Z. Updated 2026-08-26T16:11:11.096Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 23:11 WIB

Official record

HighPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79676

NLTK before 3.10.3 Path Traversal via Symlink Bypass

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose outside-root content thro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:01.646Z. Updated 2026-08-25T16:15:13.359Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:15 WIB

Official record

CritPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79675

NLTK before 3.10.3 JVM Argument Injection via Per-Call Options

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:00.949Z. Updated 2026-08-27T16:24:50.205Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

HighPublished 25 Aug 2026, 22:16 WIB

CVE-2026-79674

NLTK 3.10.2 Path Traversal via corpus-reader constructors

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:16:00.226Z. Updated 2026-08-25T17:42:56.934Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:42 WIB

Official record

HighPublished 25 Aug 2026, 22:15 WIB

CVE-2026-55533

PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests despite authentica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T15:15:34.856Z. Updated 2026-08-25T16:12:49.407Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:12 WIB

Official record