Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3581–3600 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 21 Aug 2026, 04:13 WIB

CVE-2026-53804

OTRS Community Edition OS Command Injection via PGP Configuration

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration values are concatenated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:13:24.493Z. Updated 2026-08-21T17:29:18.783Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 00:29 WIB

Official record

MedPublished 21 Aug 2026, 04:11 WIB

CVE-2026-75484

HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-nam…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3581 to 3600 of 12259.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:11:27.523Z. Updated 2026-08-21T19:52:42.954Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:52 WIB

Official record

HighPublished 21 Aug 2026, 04:11 WIB

CVE-2026-74836

HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level send window (default 65,5…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:11:18.999Z. Updated 2026-08-21T19:55:01.929Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:55 WIB

Official record

MedPublished 21 Aug 2026, 04:10 WIB

CVE-2026-67446

Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:10:28.074Z. Updated 2026-08-21T14:56:09.415Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 21:56 WIB

Official record

MedPublished 21 Aug 2026, 04:09 WIB

CVE-2026-77641

CVE-2026-77641

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:09:41.229Z. Updated 2026-08-27T16:06:56.149Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:06 WIB

Official record

MedPublished 21 Aug 2026, 04:08 WIB

CVE-2026-68921

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight without escaping in pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:08:43.813Z. Updated 2026-08-21T11:32:29.303Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:32 WIB

Official record

MedPublished 21 Aug 2026, 04:07 WIB

CVE-2026-70654

libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vips_source_read_to_memory in libvips/iofuncs/source.c. The function uses VIPS_MAX i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:07:25.540Z. Updated 2026-08-21T11:35:46.559Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:35 WIB

Official record

UnscoredPublished 21 Aug 2026, 04:07 WIB

CVE-2026-43798

CVE-2026-43798

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:07:01.719Z. Updated 2026-08-26T14:05:32.813Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:05 WIB

Official record

MedPublished 21 Aug 2026, 04:06 WIB

CVE-2026-70653

libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance image

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning of a scanline in scanline_read_old and read q[-1] before any prior pixel exists. A crafted Radiance image loaded throug…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:06:26.424Z. Updated 2026-08-21T15:37:17.272Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 22:37 WIB

Official record

MedPublished 21 Aug 2026, 04:05 WIB

CVE-2026-70651

libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations in libvips/foreign/magic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:05:38.765Z. Updated 2026-08-25T15:25:19.181Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:25 WIB

Official record

LowPublished 21 Aug 2026, 04:04 WIB

CVE-2026-70652

libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vips_foreign_save_uhdr_set_raw_hdr when a pipeline enlarges an incoming JPEG to a very large output before encoding…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:04:51.898Z. Updated 2026-08-21T21:45:43.586Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:45 WIB

Official record

HighPublished 21 Aug 2026, 04:02 WIB

CVE-2026-69242

libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vips_image_sanity. The resulting buffer-region calculation can access attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:02:58.466Z. Updated 2026-08-21T16:20:09.170Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:20 WIB

Official record

LowPublished 21 Aug 2026, 04:02 WIB

CVE-2026-77640

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no input remaining, which buf_add_compress() mistook for a full output buffer and retried forever. Fixed by returning TO…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:02:36.470Z. Updated 2026-08-21T20:08:38.526Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

CritPublished 21 Aug 2026, 04:01 WIB

CVE-2026-71485

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T21:01:00.931Z. Updated 2026-08-25T15:23:47.006Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:23 WIB

Official record

MedPublished 21 Aug 2026, 03:57 WIB

CVE-2026-77639

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T20:57:50.207Z. Updated 2026-08-21T20:08:38.672Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

HighPublished 21 Aug 2026, 03:52 WIB

CVE-2026-77638

CVE-2026-77638

Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.

Excerpt language: en.

Severity high: primary CNA CVSS 8.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T20:52:29.708Z. Updated 2026-08-27T16:06:47.809Z.

CVSS8.9v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:06 WIB

Official record

UnscoredPublished 21 Aug 2026, 03:51 WIB

CVE-2026-76023

CVE-2026-76023

Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T20:51:20.725Z. Updated 2026-08-22T03:56:31.696Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:56 WIB

Official record

UnscoredPublished 21 Aug 2026, 03:51 WIB

CVE-2026-76022

CVE-2026-76022

Buffer overflow in Network in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T20:51:20.515Z. Updated 2026-08-22T03:56:30.636Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:56 WIB

Official record

UnscoredPublished 21 Aug 2026, 03:51 WIB

CVE-2026-76021

CVE-2026-76021

Use after free in DOM in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T20:51:20.309Z. Updated 2026-08-22T03:56:29.556Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:56 WIB

Official record

UnscoredPublished 21 Aug 2026, 03:51 WIB

CVE-2026-76020

CVE-2026-76020

Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T20:51:20.076Z. Updated 2026-08-22T03:56:28.497Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:56 WIB

Official record