Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 3521–3540 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 10 Apr 2026, 23:03 WIB

CVE-2026-35651

OpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval Prompt

OpenClaw versions 2026.2.13 through 2026.3.24 contain an ANSI escape sequence injection vulnerability in approval prompts that allows attackers to spoof terminal output. Untrusted tool metadata can carry ANSI control sequences into approval prompts and permission logs, enabling attackers to manipulate displayed informa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T16:03:14.791Z. Updated 2026-06-23T16:16:08.793Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

HighPublished 10 Apr 2026, 23:03 WIB

CVE-2026-35650

OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitization

OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malformed override keys that slip through inconsistent validation to execute arbitrary co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3521 to 3540 of 5813.First page Next page

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T16:03:13.984Z. Updated 2026-06-23T16:16:08.141Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

MedPublished 10 Apr 2026, 23:03 WIB

CVE-2026-35649

OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist

OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty allowlist handling. The vulnerability treats explicit empty allowlists as unset during reconciliation, silently undoing intended access control denials and restori…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T16:03:13.290Z. Updated 2026-06-23T16:16:07.457Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

LowPublished 10 Apr 2026, 23:03 WIB

CVE-2026-35648

OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions

OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy tightening to execute unauthorized commands.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T16:03:12.588Z. Updated 2026-06-23T16:16:06.725Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

MedPublished 10 Apr 2026, 23:03 WIB

CVE-2026-35647

OpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification Notices

OpenClaw before 2026.3.25 contains an access control vulnerability where verification notices bypass DM policy checks and reply to unpaired peers. Attackers can send verification notices to users outside allowed direct message policies by exploiting insufficient access validation before message transmission.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T16:03:11.903Z. Updated 2026-06-23T16:16:06.024Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

HighPublished 10 Apr 2026, 23:03 WIB

CVE-2026-35643

OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface

OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application context.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T16:03:11.209Z. Updated 2026-06-23T16:16:03.143Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

HighPublished 10 Apr 2026, 23:03 WIB

CVE-2026-35641

OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can leverage git dependenci…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T16:03:10.490Z. Updated 2026-06-23T16:16:01.767Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

HighPublished 10 Apr 2026, 23:03 WIB

CVE-2026-35621

OpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence

OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, allowing operator.write-scoped clients to mutate channel authorization policy. Attackers can exploit chat.send to build an internal command-authorized con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T16:03:09.856Z. Updated 2026-06-23T16:15:47.418Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

MedPublished 10 Apr 2026, 23:03 WIB

CVE-2026-35620

OpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commands

OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner command-authorized senders to change owner-only session delivery policy settings, and the /allowlist mutating commands fail to enforce operator.admin scope. Atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T16:03:09.127Z. Updated 2026-06-23T16:15:46.663Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

MedPublished 10 Apr 2026, 23:03 WIB

CVE-2026-35619

OpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint

OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements. Attackers with only operator.approvals scope can enumerate gateway model metadata through the HTTP compatibility route, bypassing the stricter WebSocket RPC au…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T16:03:08.449Z. Updated 2026-06-23T16:15:45.943Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

MedPublished 10 Apr 2026, 22:59 WIB

CVE-2026-35596

Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:59:43.255Z. Updated 2026-04-14T14:51:51.537Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 21:51 WIB

Official record

HighPublished 10 Apr 2026, 22:58 WIB

CVE-2026-35595

Vikunja Affected by Privilege Escalation via Project Reparenting

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's permission model uses a recursive CTE that walks up the project hierarchy …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:58:32.658Z. Updated 2026-04-10T18:16:18.230Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated11 Apr 2026, 01:16 WIB

Official record

MedPublished 10 Apr 2026, 22:55 WIB

CVE-2026-35594

Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:55:04.929Z. Updated 2026-04-14T14:32:15.339Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 21:32 WIB

Official record

LowPublished 10 Apr 2026, 22:48 WIB

CVE-2026-40228

CVE-2026-40228

In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:48:44.215Z. Updated 2026-05-05T01:34:55.360Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated05 May 2026, 08:34 WIB

Official record

MedPublished 10 Apr 2026, 22:45 WIB

CVE-2026-40023

Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters

Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:45:52.895Z. Updated 2026-04-10T17:29:20.009Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated11 Apr 2026, 00:29 WIB

Official record

HighPublished 10 Apr 2026, 22:45 WIB

CVE-2026-34727

Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:45:30.662Z. Updated 2026-04-13T15:37:32.071Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated13 Apr 2026, 22:37 WIB

Official record

MedPublished 10 Apr 2026, 22:44 WIB

CVE-2026-40021

Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters

Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https:/…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:44:17.451Z. Updated 2026-04-10T17:35:01.228Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated11 Apr 2026, 00:35 WIB

Official record

MedPublished 10 Apr 2026, 22:43 WIB

CVE-2026-34481

Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:43:00.100Z. Updated 2026-07-11T04:55:42.502Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated11 Jul 2026, 11:55 WIB

Official record

MedPublished 10 Apr 2026, 22:42 WIB

CVE-2026-34480

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:42:03.843Z. Updated 2026-04-10T17:45:07.434Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Apr 2026, 00:45 WIB

Official record

MedPublished 10 Apr 2026, 22:41 WIB

CVE-2026-34479

Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:41:07.888Z. Updated 2026-04-10T17:47:34.402Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Apr 2026, 00:47 WIB

Official record