Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3641–3660 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 21 Aug 2026, 01:09 WIB

CVE-2026-63003

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidde…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T18:09:13.988Z. Updated 2026-08-21T21:46:19.864Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:46 WIB

Official record

MedPublished 21 Aug 2026, 01:07 WIB

CVE-2026-61663

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3641 to 3660 of 12259.First page Next page

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T18:07:28.005Z. Updated 2026-08-25T15:16:01.718Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:16 WIB

Official record

MedPublished 21 Aug 2026, 01:06 WIB

CVE-2026-54622

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placehold…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T18:06:00.186Z. Updated 2026-08-20T18:50:59.089Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:50 WIB

Official record

MedPublished 21 Aug 2026, 01:04 WIB

CVE-2026-54624

django CMS: Structure endpoint bypasses page-view permission

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T18:04:38.766Z. Updated 2026-08-20T19:46:10.950Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:46 WIB

Official record

CritPublished 21 Aug 2026, 01:03 WIB

CVE-2026-2334

) Missing Server-Side File Extension Validation in vsDesk

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Execution (RCE) within the con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T18:03:38.982Z. Updated 2026-08-21T20:08:38.818Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

HighPublished 21 Aug 2026, 01:02 WIB

CVE-2026-54623

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T18:02:45.599Z. Updated 2026-08-20T18:47:19.789Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:47 WIB

Official record

MedPublished 21 Aug 2026, 00:58 WIB

CVE-2026-54625

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the decla…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:58:03.255Z. Updated 2026-08-20T19:45:17.403Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:45 WIB

Official record

CritPublished 21 Aug 2026, 00:55 WIB

CVE-2026-63385

Libevent: HTTP header handling bugs create risk of access control bypass.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:55:36.214Z. Updated 2026-08-21T21:46:26.752Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:46 WIB

Official record

MedPublished 21 Aug 2026, 00:55 WIB

CVE-2026-63379

Libevent: HTTP Header smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:55:00.789Z. Updated 2026-08-25T15:14:26.228Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:14 WIB

Official record

HighPublished 21 Aug 2026, 00:53 WIB

CVE-2026-63387

Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus la…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:53:41.863Z. Updated 2026-08-25T15:12:12.129Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:12 WIB

Official record

HighPublished 21 Aug 2026, 00:53 WIB

CVE-2026-63384

Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or tru…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:53:08.417Z. Updated 2026-08-20T19:50:32.085Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:50 WIB

Official record

MedPublished 21 Aug 2026, 00:52 WIB

CVE-2026-63380

Libevent: Null Pointer Dereference in `evws_new_session`

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMO…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:52:29.458Z. Updated 2026-08-25T15:11:16.746Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:11 WIB

Official record

CritPublished 21 Aug 2026, 00:51 WIB

CVE-2026-63382

libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:51:15.156Z. Updated 2026-08-20T19:33:50.217Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:33 WIB

Official record

MedPublished 21 Aug 2026, 00:50 WIB

CVE-2026-63381

Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:50:09.322Z. Updated 2026-08-21T21:46:33.792Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:46 WIB

Official record

HighPublished 21 Aug 2026, 00:49 WIB

CVE-2026-63495

Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:49:16.790Z. Updated 2026-08-20T19:17:04.616Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:17 WIB

Official record

HighPublished 21 Aug 2026, 00:48 WIB

CVE-2026-63383

Libevent: decode_tag_internal() can lead to out-of-bounds read

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:48:24.568Z. Updated 2026-08-20T18:41:23.897Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:41 WIB

Official record

HighPublished 21 Aug 2026, 00:44 WIB

CVE-2026-63388

Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:44:18.435Z. Updated 2026-08-21T21:46:40.675Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:46 WIB

Official record

CritPublished 21 Aug 2026, 00:41 WIB

CVE-2026-73253

Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:41:02.495Z. Updated 2026-08-20T18:36:17.262Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:36 WIB

Official record

MedPublished 21 Aug 2026, 00:40 WIB

CVE-2026-73255

Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:40:02.443Z. Updated 2026-08-25T15:09:33.679Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:09 WIB

Official record

MedPublished 21 Aug 2026, 00:39 WIB

CVE-2026-73259

Mongoose: Reflected XSS via decoded URI in directory listing render

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:39:16.147Z. Updated 2026-08-20T19:51:19.095Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:51 WIB

Official record