Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 341–360 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 29 Apr 2026, 02:30 WIB

CVE-2026-7306

Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key

A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/com/xxl/job/admin/scheduler/openapi/OpenApiController.java of the component OpenAPI Endpoint. Such manipulation of the argument default_token leads to use of har…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T19:30:13.749Z. Updated 2026-04-30T12:58:07.137Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 19:58 WIB

Official record

MedPublished 29 Apr 2026, 02:15 WIB

CVE-2026-7305

Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery

A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src/main/java/com/xxl/job/admin/service/impl/XxlJobServiceImpl.java of the component trigger Endpoint. This manipulation of the argument addressList causes server-side request forgery…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 341 to 360 of 5813.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T19:15:13.287Z. Updated 2026-04-29T13:09:52.781Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:09 WIB

Official record

MedPublished 29 Apr 2026, 02:00 WIB

CVE-2026-7303

Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection

A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T19:00:17.015Z. Updated 2026-04-29T13:11:38.122Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:11 WIB

Official record

MedPublished 29 Apr 2026, 01:45 WIB

CVE-2026-7297

SourceCodester Pizzafy Ecommerce System ajax.php save_user cross site scripting

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function save_user of the file /admin/ajax.php?action=save_user. Executing a manipulation of the argument Name can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:45:12.251Z. Updated 2026-04-29T15:10:21.529Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 22:10 WIB

Official record

MedPublished 29 Apr 2026, 01:30 WIB

CVE-2026-7296

SourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scripting

A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_order of the file /admin/ajax.php?action=save_order. Performing a manipulation of the argument first_name results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:30:13.871Z. Updated 2026-04-29T12:13:39.571Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:13 WIB

Official record

MedPublished 29 Apr 2026, 01:15 WIB

CVE-2026-7295

SourceCodester Pizzafy Ecommerce System ajax.php save_menu cross site scripting

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?action=save_menu. Such manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:15:11.370Z. Updated 2026-04-29T14:56:51.412Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 21:56 WIB

Official record

HighPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42432

OpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the operator.admin scope requirement. Attackers can bypass re-pairing authentication to execute privileged commands on the local assistant system.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:20.570Z. Updated 2026-05-26T11:52:18.328Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 18:52 WIB

Official record

HighPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42431

OpenClaw < 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypass

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent profile-mutation guard and modify browser configurations.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:19.862Z. Updated 2026-04-29T13:12:30.165Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:12 WIB

Official record

MedPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42430

OpenClaw < 2026.4.8 - Strict Browser SSRF Bypass via Playwright Redirect Handling

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF checks. Attackers can exploit request-time navigation to reach private targets that should be restricted by browser SSRF protections.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:19.089Z. Updated 2026-04-30T12:56:49.919Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 19:56 WIB

Official record

MedPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42429

OpenClaw < 2026.4.8 - Privilege Escalation via Gateway Plugin HTTP Authentication

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.read requests to runtime operator.write permissions. Attackers can exploit this by sending read-scoped requests through the gateway auth route to gain unaut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:18.245Z. Updated 2026-05-26T11:52:17.581Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 18:52 WIB

Official record

HighPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42428

OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:17.510Z. Updated 2026-04-29T12:14:50.350Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:14 WIB

Official record

MedPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42427

OpenClaw < 2026.4.8 - Remote Code Execution via Build Tool Environment Variable Injection

OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS. Attackers can inject malicious build tool environment variables to influence host exec commands and achieve arbitrary cod…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:16.722Z. Updated 2026-04-29T15:10:29.927Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 22:10 WIB

Official record

HighPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42426

OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attackers with operator.write permissions can bypass pairing approval restriction…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:15.633Z. Updated 2026-04-29T18:26:40.673Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 01:26 WIB

Official record

MedPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42424

OpenClaw < 2026.4.8 - Local File Exfiltration via Shared Reply MEDIA Paths

OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references to cause another channel to read local file paths as trusted generated media.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:14.930Z. Updated 2026-04-29T13:13:07.530Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:13 WIB

Official record

HighPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42423

OpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that should require explicit user approval, circumventing the intended securi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:14.230Z. Updated 2026-04-30T12:55:53.497Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 19:55 WIB

Official record

HighPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42422

OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function

OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not undergone intended approval.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:13.468Z. Updated 2026-04-29T13:04:25.035Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:04 WIB

Official record

LowPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42421

OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation

OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:12.669Z. Updated 2026-04-29T12:15:24.542Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:15 WIB

Official record

MedPublished 29 Apr 2026, 01:10 WIB

CVE-2026-42420

OpenClaw < 2026.4.8 - Improper Base64 Decoding Size Validation

OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exploit multiple code paths to cause memory exhaustion or denial of service through crafted base64-encoded input.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:11.948Z. Updated 2026-04-29T15:10:38.714Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 22:10 WIB

Official record

LowPublished 29 Apr 2026, 01:10 WIB

CVE-2026-41916

OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload

OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through config reload operation…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:10.910Z. Updated 2026-04-29T19:01:15.552Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 02:01 WIB

Official record

MedPublished 29 Apr 2026, 01:10 WIB

CVE-2026-41915

OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment

OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit this by setting GIT_DIR and related variables to redirect git operations and compromise repository integrity.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:10:10.174Z. Updated 2026-04-29T13:15:23.536Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:15 WIB

Official record