Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3561–3580 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 21 Aug 2026, 04:35 WIB

CVE-2026-55491

BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script content, and the script…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:35:42.546Z. Updated 2026-08-21T15:50:11.735Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 22:50 WIB

Official record

MedPublished 21 Aug 2026, 04:35 WIB

CVE-2026-72860

9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate after a redirect, and it…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3561 to 3580 of 12259.First page Next page

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:35:14.677Z. Updated 2026-09-24T14:19:04.082Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

HighPublished 21 Aug 2026, 04:34 WIB

CVE-2026-46355

BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:34:40.529Z. Updated 2026-08-25T15:26:14.221Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:26 WIB

Official record

HighPublished 21 Aug 2026, 04:34 WIB

CVE-2026-16946

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a heap buffer overflow.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:34:24.295Z. Updated 2026-08-22T03:56:39.187Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:56 WIB

Official record

HighPublished 21 Aug 2026, 04:34 WIB

CVE-2026-16945

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a stack-based buffer overflow.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:34:06.650Z. Updated 2026-08-26T14:16:17.667Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:16 WIB

Official record

HighPublished 21 Aug 2026, 04:33 WIB

CVE-2026-46682

BigBlueButton: Blind SQL Injection AUTH (Moderator)

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:33:56.431Z. Updated 2026-08-21T21:45:22.172Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:45 WIB

Official record

MedPublished 21 Aug 2026, 04:33 WIB

CVE-2026-16944

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a stack-based buffer overflow.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:33:49.336Z. Updated 2026-08-22T03:56:37.070Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:56 WIB

Official record

HighPublished 21 Aug 2026, 04:33 WIB

CVE-2026-16943

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a heap-based buffer overflow.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:33:32.037Z. Updated 2026-08-21T15:58:59.828Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 22:58 WIB

Official record

HighPublished 21 Aug 2026, 04:33 WIB

CVE-2026-16937

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:33:05.290Z. Updated 2026-08-22T03:56:35.997Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:56 WIB

Official record

HighPublished 21 Aug 2026, 04:32 WIB

CVE-2026-55893

Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call set_reg() and set_reg_n() using sh_info.op.op_count without checking the fixed-size operands[] array. Repeated crafted instructions processed through c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:32:46.718Z. Updated 2026-08-21T21:45:29.340Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:45 WIB

Official record

HighPublished 21 Aug 2026, 04:32 WIB

CVE-2026-16936

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:32:46.429Z. Updated 2026-08-22T03:56:34.939Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:56 WIB

Official record

HighPublished 21 Aug 2026, 04:32 WIB

CVE-2026-16935

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a time-of-check to time-of-use (TOCTOU) race condition.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:32:12.330Z. Updated 2026-08-26T14:16:26.363Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:16 WIB

Official record

HighPublished 21 Aug 2026, 04:31 WIB

CVE-2026-16934

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a heap-based buffer overflow.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:31:47.434Z. Updated 2026-08-22T03:56:32.808Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:56 WIB

Official record

MedPublished 21 Aug 2026, 04:31 WIB

CVE-2026-55894

Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode[] function-pointer table. An application using CS_ARCH_SH with CS_MODE_SH2A or…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:31:37.680Z. Updated 2026-08-21T15:00:05.011Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 22:00 WIB

Official record

MedPublished 21 Aug 2026, 04:29 WIB

CVE-2026-67448

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to retur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:29:06.185Z. Updated 2026-08-21T11:31:27.439Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:31 WIB

Official record

MedPublished 21 Aug 2026, 04:23 WIB

CVE-2026-77643

CVE-2026-77643

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:23:31.317Z. Updated 2026-08-28T18:08:32.929Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:08 WIB

Official record

UnscoredPublished 21 Aug 2026, 04:16 WIB

CVE-2026-64773

CVE-2026-64773

An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. Thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:16:08.187Z. Updated 2026-10-19T20:48:44.024Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Oct 2026, 03:48 WIB

Official record

HighPublished 21 Aug 2026, 04:15 WIB

CVE-2026-77642

CVE-2026-77642

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:15:49.660Z. Updated 2026-08-27T16:07:03.716Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:07 WIB

Official record

MedPublished 21 Aug 2026, 04:15 WIB

CVE-2026-67447

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a singl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:15:06.567Z. Updated 2026-08-21T16:19:21.564Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:19 WIB

Official record

MedPublished 21 Aug 2026, 04:13 WIB

CVE-2026-67445

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP clien…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:13:27.481Z. Updated 2026-08-21T21:45:36.467Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:45 WIB

Official record