Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 3541–3560 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 10 Apr 2026, 22:40 WIB

CVE-2026-34478

Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based sy…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:40:17.713Z. Updated 2026-04-10T17:50:12.484Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Apr 2026, 00:50 WIB

Official record

MedPublished 10 Apr 2026, 22:36 WIB

CVE-2026-34477

Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3541 to 3560 of 5813.First page Next page

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:36:19.740Z. Updated 2026-04-10T17:38:57.154Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated11 Apr 2026, 00:38 WIB

Official record

MedPublished 10 Apr 2026, 22:35 WIB

CVE-2026-29043

HDF5 H5T__ref_mem_setnull Heap Buffer Overflow

HDF5 is software for managing data. In 1.14.1-2 and earlier, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition in the H5T__ref_mem_setnull method. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution dep…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:35:51.682Z. Updated 2026-04-14T14:50:46.566Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 21:50 WIB

Official record

MedPublished 10 Apr 2026, 22:19 WIB

CVE-2026-40227

CVE-2026-40227

In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:19:51.433Z. Updated 2026-04-14T14:49:32.971Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 21:49 WIB

Official record

MedPublished 10 Apr 2026, 22:18 WIB

CVE-2026-40226

CVE-2026-40226

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:18:10.447Z. Updated 2026-04-14T14:48:20.451Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 21:48 WIB

Official record

MedPublished 10 Apr 2026, 22:16 WIB

CVE-2026-40225

CVE-2026-40225

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:16:19.827Z. Updated 2026-04-14T14:40:30.611Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 21:40 WIB

Official record

MedPublished 10 Apr 2026, 22:14 WIB

CVE-2026-40224

CVE-2026-40224

In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:14:21.904Z. Updated 2026-04-10T18:13:05.818Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated11 Apr 2026, 01:13 WIB

Official record

HighPublished 10 Apr 2026, 22:11 WIB

CVE-2026-29002

CouchCMS Privilege Escalation via f_k_levels_list Parameter

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:11:43.411Z. Updated 2026-07-14T18:39:48.416Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:39 WIB

Official record

MedPublished 10 Apr 2026, 22:10 WIB

CVE-2026-40223

CVE-2026-40223

In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T15:10:56.605Z. Updated 2026-04-15T14:42:11.727Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 21:42 WIB

Official record

HighPublished 10 Apr 2026, 20:43 WIB

CVE-2026-40217

CVE-2026-40217

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T13:43:23.147Z. Updated 2026-07-15T01:01:14.184Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:01 WIB

Official record

UnscoredPublished 10 Apr 2026, 20:30 WIB

CVE-2026-6069

CVE-2026-6069

NASM’s disasm() function contains a stack based buffer overflow when formatting disassembly output, allowing an attacker triggered out-of-bounds write when `slen` exceeds the buffer capacity.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T13:30:48.302Z. Updated 2026-04-10T14:53:37.082Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Apr 2026, 21:53 WIB

Official record

UnscoredPublished 10 Apr 2026, 20:30 WIB

CVE-2026-6068

CVE-2026-6068

NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed memory is stored in the global depend_file and later dereferenced, as the response-file buffer is freed before the pointer is used, allowing for data corruption or remote code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T13:30:38.420Z. Updated 2026-05-20T14:02:31.446Z.

CVSS—KEVNot listedEPSSPresentUpdated20 May 2026, 21:02 WIB

Official record

UnscoredPublished 10 Apr 2026, 20:30 WIB

CVE-2026-6067

CVE-2026-6067

A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_directive() function. This vulnerability can be exploited by a user assembling a malicious .asm file, potentially leading to heap memory corruption, denial of service (crash), and arbitrary code execu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T13:30:26.140Z. Updated 2026-04-10T14:58:07.818Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Apr 2026, 21:58 WIB

Official record

HighPublished 10 Apr 2026, 20:25 WIB

CVE-2025-58920

WordPress Cerato theme <= 2.2.18 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zootemplate Cerato cerato allows Reflected XSS.This issue affects Cerato: from n/a through <= 2.2.18.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T13:25:31.611Z. Updated 2026-04-28T16:13:49.426Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 10 Apr 2026, 20:21 WIB

CVE-2025-58913

WordPress VideoPro theme <= 2.3.8.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CactusThemes VideoPro videopro allows PHP Local File Inclusion.This issue affects VideoPro: from n/a through <= 2.3.8.1.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T13:21:05.820Z. Updated 2026-04-28T16:13:49.305Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 10 Apr 2026, 20:19 WIB

CVE-2025-5804

WordPress Case Theme User < 1.0.4 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case Themes Case Theme User case-theme-user allows PHP Local File Inclusion.This issue affects Case Theme User: from n/a through < 1.0.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T13:19:43.457Z. Updated 2026-04-28T16:13:41.220Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 10 Apr 2026, 20:17 WIB

CVE-2026-33092

CVE-2026-33092

Local privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (macOS) before build 42571, Acronis True Image (macOS) before build 42902.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T13:17:45.275Z. Updated 2026-04-14T03:55:40.860Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated14 Apr 2026, 10:55 WIB

Official record

CritPublished 10 Apr 2026, 19:22 WIB

CVE-2026-5412

Juju CloudSpec API could leak senstive information

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juj…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T12:22:05.403Z. Updated 2026-04-10T14:04:30.155Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated10 Apr 2026, 21:04 WIB

Official record

MedPublished 10 Apr 2026, 19:10 WIB

CVE-2026-5774

Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T12:10:55.634Z. Updated 2026-04-10T12:41:28.720Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated10 Apr 2026, 19:41 WIB

Official record

HighPublished 10 Apr 2026, 18:40 WIB

CVE-2026-5777

Security Misconfiguration Vulnerability in Atom 3x Projector

This vulnerability exists in the Atom 3x Projector due to improper exposure of the Android Debug Bridge (ADB) service over the local network without authentication or access controls. An unauthenticated attacker on the same network can exploit this vulnerability to obtain root-level access, leading to complete compromi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-10T11:40:55.335Z. Updated 2026-04-10T12:42:10.282Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Apr 2026, 19:42 WIB

Official record