Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,616 published records · 20 KEV · 4,616 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,616 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3317.2%
High1,42031%
Med1,98843%
Low2104.5%
None360.78%
Legacy00.00%
Unscored63114%

Matching records by UTC month

Feb 264,616

Signal coverage

KEV-listed: 20
With a forecast: 4,616
Unknown date: 0
Unscored severity: 631

Share of cohort: KEV 0.43% · forecast 100% · unscored 14%.

Showing 361–380 of 4,616By severity band: Critical · 9.0–10.0 331, High · 7.0–8.9 1,420, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 210, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 631

MedPublished 26 Feb 2026, 07:27 WIB

CVE-2026-27840

ZITADEL's truncated opaque tokens are still valid

ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.0, opaque OIDC access tokens in the v2 format truncated to 80 characters are still considered valid. Zitadel uses a symmetric AES encryption for opaque tokens. The cleartext payload is a concatenatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:27:08.933Z. Updated 2026-02-26T17:00:29.815Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:00 WIB

Official record

MedPublished 26 Feb 2026, 07:19 WIB

CVE-2026-27837

Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()

Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 361 to 380 of 4616.First page Next page

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:19:24.289Z. Updated 2026-02-26T14:40:07.451Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 21:40 WIB

Official record

HighPublished 26 Feb 2026, 07:11 WIB

CVE-2026-27831

rldns Vulnerable to Heap-based Out-of-Bounds Read

rldns is an open source DNS server. Version 1.3 has a heap-based out-of-bounds read that leads to denial of service. Version 1.4 contains a patch for the issue.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:11:45.608Z. Updated 2026-02-27T15:24:12.727Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 22:24 WIB

Official record

HighPublished 26 Feb 2026, 07:08 WIB

CVE-2026-27821

GPAC NHML Demuxer (dmx_nhml.c) Vulnerable to Stack Buffer Overflow

GPAC is an open-source multimedia framework. In versions up to and including 26.02.0, a stack buffer overflow occurs during NHML file parsing in `src/filters/dmx_nhml.c`. The value of the xmlHeaderEnd XML attribute is copied from att->value into szXmlHeaderEnd[1000] using strcpy() without any length validation. If the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:08:39.924Z. Updated 2026-02-26T15:15:39.671Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:15 WIB

Official record

MedPublished 26 Feb 2026, 07:05 WIB

CVE-2026-26186

Fleet has a SQL injection via backtick escape in ORDER BY parameter

Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the `order_key` query parameter. Due to unsafe use of `goqu.I()` when constructing the `ORDER BY` clause, specially crafted input could escape id…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:05:02.016Z. Updated 2026-02-26T14:52:24.634Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 21:52 WIB

Official record

HighPublished 26 Feb 2026, 07:02 WIB

CVE-2026-27818

TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist

TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:02:45.127Z. Updated 2026-02-26T15:16:30.580Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:16 WIB

Official record

HighPublished 26 Feb 2026, 07:00 WIB

CVE-2026-27812

Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning (Host Header / Forwarded Header trust issue), which allows attackers to manipulate the password reset link. Attackers can exploit th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:00:10.239Z. Updated 2026-02-26T14:53:58.840Z.

CVSS8v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 21:53 WIB

Official record

UnscoredPublished 26 Feb 2026, 07:00 WIB

CVE-2025-50857

CVE-2025-50857

ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a crafted file upload

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:00:00.000Z. Updated 2026-02-26T18:48:30.603Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:48 WIB

Official record

UnscoredPublished 26 Feb 2026, 07:00 WIB

CVE-2025-56605

CVE-2025-56605

A reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event Management System 1.0. The mobile POST parameter is improperly validated and echoed back in the HTTP response without sanitization, allowing an attacker to inject and execute arbitrary JavaScript code …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:00:00.000Z. Updated 2026-02-26T17:06:15.835Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:06 WIB

Official record

UnscoredPublished 26 Feb 2026, 07:00 WIB

CVE-2025-71057

CVE-2025-71057

Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:00:00.000Z. Updated 2026-07-05T01:29:06.495Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:29 WIB

Official record

UnscoredPublished 26 Feb 2026, 07:00 WIB

CVE-2026-26682

CVE-2026-26682

An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-26T00:00:00.000Z. Updated 2026-02-26T18:53:00.554Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:53 WIB

Official record

MedPublished 26 Feb 2026, 06:57 WIB

CVE-2026-27809

psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data (e.g. a literal run that extends past the expected row size), decode_rle() raises ValueError which propagated all the way to the user, crashing psd.composite() …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T23:57:00.760Z. Updated 2026-02-26T15:17:34.807Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:17 WIB

Official record

MedPublished 26 Feb 2026, 06:51 WIB

CVE-2026-27808

Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API

Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API (/api/v1/message/{ID}/link-check) is vulnerable to Server-Side Request Forgery (SSRF). The server performs HTTP HEAD requests to every URL found in an email without validating target hosts or filtering private/internal …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T23:51:20.365Z. Updated 2026-02-26T15:47:56.826Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:47 WIB

Official record

CritPublished 26 Feb 2026, 06:48 WIB

CVE-2026-27804

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with `alg: "none"` to log in as any user linked to a Google account, without knowing their credentials. A…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T23:48:20.858Z. Updated 2026-02-26T17:03:50.903Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:03 WIB

Official record

MedPublished 26 Feb 2026, 06:45 WIB

CVE-2026-27735

mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T23:45:52.077Z. Updated 2026-02-26T17:04:59.103Z.

CVSS6.4v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:04 WIB

Official record

MedPublished 26 Feb 2026, 06:44 WIB

CVE-2026-27711

NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length

NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a memory corruption vulnerability in NanaZip’s UFS parser allows a crafted `.ufs/.ufs2/.img` file to trigger out-of-bounds memory access during archive open/listing. The bug is reachable via normal us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T23:44:26.848Z. Updated 2026-02-26T15:07:47.597Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:07 WIB

Official record

MedPublished 26 Feb 2026, 06:43 WIB

CVE-2026-27710

NanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS)

NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a denial-of-service vulnerability exists in NanaZip’s `.NET Single File Application` parser. A crafted bundle can force an integer underflow in header-size calculation and trigger an unbounded memory …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T23:43:28.219Z. Updated 2026-02-26T15:48:29.934Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:48 WIB

Official record

MedPublished 26 Feb 2026, 06:39 WIB

CVE-2026-27709

NanaZip .NET Single-File Manifest Parser Vulnerable to Out-of-Bounds Read via Unchecked RelativePathLength

NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, NanaZip’s `.NET Single File Application` parser has an out-of-bounds read vulnerability in manifest parsing. A crafted bundle can provide a malformed `RelativePathLength` so the parser constructs a `s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T23:39:03.772Z. Updated 2026-02-26T15:49:04.311Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:49 WIB

Official record

HighPublished 26 Feb 2026, 06:34 WIB

CVE-2026-27976

Zed Extension Sandbox Escape via Tar Symlink Following

Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_extension`) only performs lexical prefix checks without resolving symlinks. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T23:34:40.103Z. Updated 2026-02-27T04:55:52.466Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 11:55 WIB

Official record

HighPublished 26 Feb 2026, 06:33 WIB

CVE-2026-27967

Symlink Escape in Agent File Tools

Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools (`read_file`, `edit_file`). It allows reading and writing files **outside the project directory** when a project contains symbolic links pointing to external paths. This bypasses the intended workspace boundary and p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T23:33:21.477Z. Updated 2026-02-28T04:55:28.156Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 11:55 WIB

Official record