Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3661–3680 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

CritPublished 21 Aug 2026, 00:37 WIB

CVE-2026-73256

Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:37:54.505Z. Updated 2026-08-21T21:46:47.832Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:46 WIB

Official record

MedPublished 21 Aug 2026, 00:37 WIB

CVE-2026-73254

Mongoose: Stored XSS via unescaped filenames in directory listing

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3661 to 3680 of 12259.First page Next page

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:37:17.245Z. Updated 2026-08-21T16:22:13.424Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:22 WIB

Official record

MedPublished 21 Aug 2026, 00:36 WIB

CVE-2026-73258

Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when eith…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:36:39.239Z. Updated 2026-08-20T18:32:51.938Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:32 WIB

Official record

CritPublished 21 Aug 2026, 00:34 WIB

CVE-2026-73251

Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification

Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:34:50.472Z. Updated 2026-08-20T19:50:32.555Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:50 WIB

Official record

HighPublished 21 Aug 2026, 00:31 WIB

CVE-2026-76641

Expat Out-of-Bounds Read via dtdCopy

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:31:10.610Z. Updated 2026-10-01T15:21:11.093Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

CritPublished 21 Aug 2026, 00:30 WIB

CVE-2026-73257

Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prior…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:30:58.424Z. Updated 2026-08-20T19:34:58.840Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:34 WIB

Official record

MedPublished 21 Aug 2026, 00:30 WIB

CVE-2026-77036

elunez eladmin GenConfigController improper authorization

A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The project w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:30:13.098Z. Updated 2026-08-25T15:08:13.602Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:08 WIB

Official record

CritPublished 21 Aug 2026, 00:27 WIB

CVE-2026-53424

Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no-op. The /3 a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:27:11.115Z. Updated 2026-08-21T19:42:21.623Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:42 WIB

Official record

HighPublished 21 Aug 2026, 00:26 WIB

CVE-2026-53425

Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses

Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by compar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:26:35.537Z. Updated 2026-08-21T19:50:34.320Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:50 WIB

Official record

LowPublished 21 Aug 2026, 00:19 WIB

CVE-2026-72847

broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_build/builder.rs and in TreeLine::unprune in src/tree/tree_line.rs, and no control-character filtering exists anywhere in the code, even though…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:19:34.678Z. Updated 2026-09-24T14:19:00.302Z.

CVSS2.4v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

MedPublished 21 Aug 2026, 00:19 WIB

CVE-2026-72844

Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections

The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_inductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are replaced by auxiliary types, so their parametric arguments escaped…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:19:34.054Z. Updated 2026-10-26T01:23:59.293Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 08:23 WIB

Official record

MedPublished 21 Aug 2026, 00:15 WIB

CVE-2026-77031

Tenda CH22 formcreateFileName command injection

A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:15:09.552Z. Updated 2026-08-20T18:28:50.477Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:28 WIB

Official record

MedPublished 21 Aug 2026, 00:00 WIB

CVE-2026-77025

itsourcecode Hospital Management System viewappointmentpending.php sql injection

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and coul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T17:00:09.124Z. Updated 2026-08-20T17:38:06.709Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 00:38 WIB

Official record

MedPublished 20 Aug 2026, 23:47 WIB

CVE-2026-54136

Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search. The route-level scope middleware validated the token doma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:47:41.918Z. Updated 2026-08-21T21:47:02.821Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:47 WIB

Official record

MedPublished 20 Aug 2026, 23:45 WIB

CVE-2026-61625

VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker wh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:45:43.024Z. Updated 2026-08-20T18:27:39.780Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:27 WIB

Official record

CritPublished 20 Aug 2026, 23:45 WIB

CVE-2026-77022

Comfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results in stack-based buffer overflow. The attack can be executed r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:45:07.012Z. Updated 2026-08-21T21:47:09.947Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:47 WIB

Official record

CritPublished 20 Aug 2026, 23:43 WIB

CVE-2026-71428

unstructured: Server-Side Request Forgery in the URL-based partitioning

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:43:01.306Z. Updated 2026-08-25T15:05:17.185Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:05 WIB

Official record

HighPublished 20 Aug 2026, 23:40 WIB

CVE-2026-65842

Plate: SSRF with response disclosure in DOCX image embedding

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the fetched image bytes in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:40:24.391Z. Updated 2026-08-21T16:23:41.084Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:23 WIB

Official record

CritPublished 20 Aug 2026, 23:38 WIB

CVE-2026-55642

dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:38:29.732Z. Updated 2026-08-20T19:31:10.082Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:31 WIB

Official record

MedPublished 20 Aug 2026, 23:35 WIB

CVE-2026-55586

SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has ove…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:35:07.359Z. Updated 2026-08-21T21:47:17.240Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:47 WIB

Official record