Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 3541–3560 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

CritPublished 14 Mar 2026, 02:32 WIB

CVE-2026-31886

Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go's filepath.Join resolves .. segments lexically, so a cal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:32:09.415Z. Updated 2026-03-13T19:43:18.359Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:43 WIB

Official record

HighPublished 14 Mar 2026, 02:28 WIB

CVE-2026-31882

Dagu SSE Authentication Bypass in Basic Auth Mode

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workfl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3541 to 3560 of 6236.First page Next page

Published 2026-03-13T19:28:25.615Z. Updated 2026-03-13T19:43:56.406Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:43 WIB

Official record

MedPublished 14 Mar 2026, 02:25 WIB

CVE-2023-40693

IBM Sterling B2B Integrator and IBM Sterling File Gateway Cross-Site Scripting

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, and 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lead…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:25:02.688Z. Updated 2026-03-13T19:44:18.750Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:44 WIB

Official record

MedPublished 14 Mar 2026, 02:22 WIB

CVE-2026-31864

JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges (Application Applet …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:22:05.168Z. Updated 2026-03-13T19:44:51.850Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:44 WIB

Official record

HighPublished 14 Mar 2026, 02:19 WIB

CVE-2026-31814

Yamux remote Panic via malformed WindowUpdate credit

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:19:41.879Z. Updated 2026-03-13T19:38:02.290Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:38 WIB

Official record

MedPublished 14 Mar 2026, 02:15 WIB

CVE-2026-31798

JumpServer Improper Certificate Validation in Custom SMS API Client

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and capture the verification c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:15:26.081Z. Updated 2026-03-13T19:38:35.576Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:38 WIB

Official record

MedPublished 14 Mar 2026, 02:15 WIB

CVE-2025-14483

IBM Sterling B2B Integrator and IBM Sterling File Gateway Information Disclosure

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 could disclose sensitive host information to authenticated users in responses that could be used in further attacks against the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:15:11.844Z. Updated 2026-03-13T19:37:32.919Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:37 WIB

Official record

MedPublished 14 Mar 2026, 02:09 WIB

CVE-2026-30961

Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:09:38.427Z. Updated 2026-03-13T19:39:14.146Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:39 WIB

Official record

MedPublished 14 Mar 2026, 02:08 WIB

CVE-2025-14504

IBM Sterling B2B Integrator and IBM Sterling File Gateway Cross-Site Scripting

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:08:37.702Z. Updated 2026-03-13T19:37:07.983Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:37 WIB

Official record

MedPublished 14 Mar 2026, 02:07 WIB

CVE-2026-30955

Gokapi vulnerable to DoS in E2E Metadata Parser

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:07:55.836Z. Updated 2026-03-13T19:39:58.108Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:39 WIB

Official record

MedPublished 14 Mar 2026, 02:07 WIB

CVE-2026-30943

Gokapi has Privilege Escalation in File Replace

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An insufficient authorization check in the file replace API allows a user with only list visibility permission (UserPermListOtherUploads) to delete another user's file by abusing the deleteNewFile flag, bypassi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:07:01.576Z. Updated 2026-03-13T19:40:38.395Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:40 WIB

Official record

MedPublished 14 Mar 2026, 02:04 WIB

CVE-2026-30915

SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:04:36.856Z. Updated 2026-03-13T19:41:17.258Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:41 WIB

Official record

MedPublished 14 Mar 2026, 02:02 WIB

CVE-2026-30914

SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:02:28.270Z. Updated 2026-03-13T19:41:55.916Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:41 WIB

Official record

MedPublished 14 Mar 2026, 02:00 WIB

CVE-2026-30853

calibre has a Path Traversal Leading to Arbitrary File Write

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py) allows an attacker to write arbitrary files to any path writable by the calibre process when a user o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T19:00:09.925Z. Updated 2026-03-13T19:42:26.573Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:42 WIB

Official record

MedPublished 14 Mar 2026, 01:57 WIB

CVE-2026-0835

CVE-2026-0835

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended funct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T18:57:35.435Z. Updated 2026-03-13T19:36:39.022Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:36 WIB

Official record

HighPublished 14 Mar 2026, 01:38 WIB

CVE-2025-71263

CVE-2025-71263

In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes. A local user can exploit this to gain root privileges. It is unlikely that UNIX v4 is running anywhere outside of a very small number of lab environments. NOTE: This v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T18:38:07.721Z. Updated 2026-03-21T22:00:54.839Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated22 Mar 2026, 05:00 WIB

Official record

MedPublished 14 Mar 2026, 01:33 WIB

CVE-2025-13702

IBM Sterling Partner Engagement Manager Cross-Site Scripting

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure withi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T18:33:12.740Z. Updated 2026-05-10T13:50:08.872Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated10 May 2026, 20:50 WIB

Official record

LowPublished 14 Mar 2026, 01:33 WIB

CVE-2025-13718

IBM Sterling Partner Engagement Manager Information Disclosure

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T18:33:07.785Z. Updated 2026-03-13T19:35:14.971Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:35 WIB

Official record

MedPublished 14 Mar 2026, 01:32 WIB

CVE-2025-13723

IBM Sterling Partner Engagement Manager Information Disclosure

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T18:32:45.559Z. Updated 2026-03-13T19:34:50.670Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:34 WIB

Official record

MedPublished 14 Mar 2026, 01:30 WIB

CVE-2025-12453

Improper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ Vertica allows Reflected XSS. The vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-13T18:30:53.495Z. Updated 2026-03-13T19:34:21.690Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated14 Mar 2026, 02:34 WIB

Official record