Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 3681–3700 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 10 Apr 2026, 04:30 WIB

CVE-2026-33779

Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication

An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper Networks Junos OS on SRX Series allows a PITM to intercept the communication of the device and get access to confidential information and potentially modify it. When an SRX device is provisioned to connect to Security Director (S…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:30:56.635Z. Updated 2026-04-13T18:06:19.571Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated14 Apr 2026, 01:06 WIB

Official record

HighPublished 10 Apr 2026, 04:30 WIB

CVE-2026-5982

D-Link DIR-605L POST Request formAdvNetwork buffer overflow

A vulnerability was found in D-Link DIR-605L 2.13B01. This vulnerability affects the function formAdvNetwork of the file /goform/formAdvNetwork of the component POST Request Handler. Performing a manipulation of the argument curTime results in buffer overflow. Remote exploitation of the attack is possible. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3681 to 3700 of 5813.First page Next page

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:30:18.192Z. Updated 2026-04-10T13:56:49.891Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Apr 2026, 20:56 WIB

Official record

HighPublished 10 Apr 2026, 04:30 WIB

CVE-2026-33775

Junos OS: MX Series: Mismatch between configured and received packet types causes memory leak in bbe-smgd

A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). If the authentication packet-type option is configured and a receiv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:30:08.528Z. Updated 2026-04-13T18:06:19.695Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated14 Apr 2026, 01:06 WIB

Official record

MedPublished 10 Apr 2026, 04:29 WIB

CVE-2026-40151

PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no authentication middleware, no API…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:29:47.415Z. Updated 2026-04-10T17:10:27.256Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated11 Apr 2026, 00:10 WIB

Official record

HighPublished 10 Apr 2026, 04:29 WIB

CVE-2026-33782

Junos OS: MX Series: In specific DHCPv6 scenarios jdhcpd memory increases continuously with subscriber logouts

A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete Denial-of-Service (DoS). In a DHCPv6 over PPPoE, or DHCPv6 over VLAN with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:29:45.496Z. Updated 2026-04-13T18:06:19.824Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated14 Apr 2026, 01:06 WIB

Official record

HighPublished 10 Apr 2026, 04:29 WIB

CVE-2026-33780

Junos OS and Junos OS Evolved: In an EVPN-MPLS scenario churn of ESI routes causes a memory leak in l2ald

A Missing Release of Memory after Effective Lifetime vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a memory leak ultimately leading to a Denial of Service (DoS). In an EVPN-MPLS scenario, routes lea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:29:20.534Z. Updated 2026-04-13T18:06:19.950Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated14 Apr 2026, 01:06 WIB

Official record

MedPublished 10 Apr 2026, 04:28 WIB

CVE-2026-33773

Junos OS: EX Series, QFX Series: If the same egress filter is configured on both an IRB and a physical interface one of those is not applied

An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks. When the same family inet or inet6 filter is applie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:28:56.625Z. Updated 2026-04-13T18:06:20.091Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Apr 2026, 01:06 WIB

Official record

MedPublished 10 Apr 2026, 04:28 WIB

CVE-2026-33786

Junos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashes

An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis control daemon (chassisd) of Juniper Networks Junos OS on SRX1600, SRX2300 and SRX4300 allows a local attacker with low privileges to cause a complete Denial of Service (DoS). When a specific 'show chassis' CLI command is executed, ch…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:28:29.648Z. Updated 2026-04-13T18:06:20.220Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated14 Apr 2026, 01:06 WIB

Official record

HighPublished 10 Apr 2026, 04:28 WIB

CVE-2026-21916

Junos OS: A low privileged user can escalate their privileges so that they can login as root

A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system. When after a user has performed a specific 'file link ...' CLI operation…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:28:05.552Z. Updated 2026-04-13T13:04:16.395Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated13 Apr 2026, 20:04 WIB

Official record

HighPublished 10 Apr 2026, 04:27 WIB

CVE-2026-40153

PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False (line 88) for security. This allows exfiltration …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:45.545Z. Updated 2026-04-13T15:37:40.235Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated13 Apr 2026, 22:37 WIB

Official record

HighPublished 10 Apr 2026, 04:27 WIB

CVE-2026-33788

Junos OS Evolved: Local, authenticated attacker can gain privileged access to FPCs

A Missing Authentication for Critical Function vulnerability in the Flexible PIC Concentrators (FPCs) of Juniper Networks Junos OS Evolved on PTX Series allows a local, authenticated attacker with low privileges to gain direct access to FPCs installed in the device. A local user with low privileges can gain direct acc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:44.046Z. Updated 2026-04-13T13:04:16.251Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated13 Apr 2026, 20:04 WIB

Official record

MedPublished 10 Apr 2026, 04:27 WIB

CVE-2026-35646

OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation

OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts, enabling attackers to g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:11.563Z. Updated 2026-06-23T16:16:05.303Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

MedPublished 10 Apr 2026, 04:27 WIB

CVE-2026-35645

OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session deletion without a request-scoped client to execute privileged operations with unint…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:10.890Z. Updated 2026-06-23T16:16:04.631Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

HighPublished 10 Apr 2026, 04:27 WIB

CVE-2026-35644

OpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots

OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive authentication informa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:10.193Z. Updated 2026-06-23T16:16:03.827Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

MedPublished 10 Apr 2026, 04:27 WIB

CVE-2026-35642

OpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism. Attackers can trigger reactions in mention-gated groups to enqueue agent-visible system events that should remain restricted.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:09.493Z. Updated 2026-06-23T16:16:02.446Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

MedPublished 10 Apr 2026, 04:27 WIB

CVE-2026-35640

OpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request Parsing

OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to trigger denial of service by exhausting server resources through forced JSON parsing befor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:08.792Z. Updated 2026-06-23T16:16:00.938Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:16 WIB

Official record

HighPublished 10 Apr 2026, 04:27 WIB

CVE-2026-35639

OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually holds. Attackers can exploit insufficient scope validation to escalate privileges …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:08.064Z. Updated 2026-06-23T16:15:59.268Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 10 Apr 2026, 04:27 WIB

CVE-2026-35638

OpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UI

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain self-declared privileged scopes without device identity verification. Attackers can exploit the device-less allow path in the trusted-proxy mechanism to maintain elevated permissions …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:07.349Z. Updated 2026-06-23T16:15:58.550Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

MedPublished 10 Apr 2026, 04:27 WIB

CVE-2026-35637

OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM

OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content before proper authorization validation occurs.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:06.620Z. Updated 2026-06-23T16:15:57.880Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 10 Apr 2026, 04:27 WIB

CVE-2026-35636

OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution

OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before enforcing visibility checks. Sandboxed child sessions can exploit this to access parent or sibling sessions that should be blocked by explicit sessionKe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T21:27:05.899Z. Updated 2026-06-23T16:15:57.175Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record