Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3441–3460 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 21 Aug 2026, 09:53 WIB

CVE-2026-65644

CVE-2026-65644

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichanne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T02:53:43.406Z. Updated 2026-08-27T19:19:36.705Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 02:19 WIB

Official record

UnscoredPublished 21 Aug 2026, 09:53 WIB

CVE-2026-65645

CVE-2026-65645

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {"$gt": "4"}) can be substituted for a string room-id or…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3441 to 3460 of 12259.First page Next page

Published 2026-08-21T02:53:43.305Z. Updated 2026-08-27T17:46:35.706Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:46 WIB

Official record

HighPublished 21 Aug 2026, 09:43 WIB

CVE-2026-73267

Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T02:43:36.017Z. Updated 2026-09-29T19:41:34.213Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:41 WIB

Official record

MedPublished 21 Aug 2026, 09:02 WIB

CVE-2026-76137

CVE-2026-76137

Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T02:02:54.389Z. Updated 2026-08-21T12:54:10.665Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 19:54 WIB

Official record

MedPublished 21 Aug 2026, 09:02 WIB

CVE-2026-76131

CVE-2026-76131

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T02:02:44.579Z. Updated 2026-08-31T00:33:50.858Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 07:33 WIB

Official record

CritPublished 21 Aug 2026, 09:02 WIB

CVE-2026-76158

Datiphy Data Management Center - External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T02:02:23.070Z. Updated 2026-08-21T13:01:03.052Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 20:01 WIB

Official record

HighPublished 21 Aug 2026, 08:47 WIB

CVE-2026-76157

Datiphy Data Management Center - Missing Authentication for Critical Function

Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T01:47:44.338Z. Updated 2026-08-21T13:08:10.120Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 20:08 WIB

Official record

MedPublished 21 Aug 2026, 08:45 WIB

CVE-2026-77392

SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has been made available to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T01:45:11.812Z. Updated 2026-08-21T10:56:20.372Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 17:56 WIB

Official record

CritPublished 21 Aug 2026, 08:44 WIB

CVE-2026-76156

Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T01:44:13.629Z. Updated 2026-08-21T13:12:39.478Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 20:12 WIB

Official record

CritPublished 21 Aug 2026, 08:40 WIB

CVE-2026-76155

Datiphy Data Management Center - Use of Default Credentials

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T01:40:36.603Z. Updated 2026-08-21T13:14:29.802Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 20:14 WIB

Official record

MedPublished 21 Aug 2026, 08:15 WIB

CVE-2026-77391

SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T01:15:12.612Z. Updated 2026-08-21T16:12:11.426Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:12 WIB

Official record

CritPublished 21 Aug 2026, 07:41 WIB

CVE-2026-77651

CVE-2026-77651

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T00:41:36.099Z. Updated 2026-08-21T13:17:52.920Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 20:17 WIB

Official record

CritPublished 21 Aug 2026, 07:40 WIB

CVE-2026-77650

CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T00:40:26.467Z. Updated 2026-08-21T13:20:06.921Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 20:20 WIB

Official record

CritPublished 21 Aug 2026, 07:39 WIB

CVE-2026-77649

CVE-2026-77649

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T00:39:02.071Z. Updated 2026-08-21T13:25:41.885Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 20:25 WIB

Official record

UnscoredPublished 21 Aug 2026, 07:39 WIB

CVE-2026-43679

CVE-2026-43679

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T00:39:00.945Z. Updated 2026-08-21T13:27:19.446Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Aug 2026, 20:27 WIB

Official record

UnscoredPublished 21 Aug 2026, 07:38 WIB

CVE-2026-20679

CVE-2026-20679

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously crafted file may lead to unexpected app termination.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T00:38:59.996Z. Updated 2026-08-21T19:48:44.209Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:48 WIB

Official record

HighPublished 21 Aug 2026, 06:57 WIB

CVE-2026-16520

CVE-2026-16520

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175(Revision 150340); Genian NA…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T23:57:34.475Z. Updated 2026-08-21T20:08:37.703Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

LowPublished 21 Aug 2026, 05:37 WIB

CVE-2026-77648

CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T22:37:31.431Z. Updated 2026-08-24T16:00:10.928Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 23:00 WIB

Official record

MedPublished 21 Aug 2026, 05:32 WIB

CVE-2026-77113

Path Traversal Vulnerability in apport-unpack

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T22:32:51.447Z. Updated 2026-08-21T20:08:37.866Z.

CVSS6.7v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

CritPublished 21 Aug 2026, 05:24 WIB

CVE-2026-77647

CVE-2026-77647

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T22:24:39.626Z. Updated 2026-08-21T20:08:38.061Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record