Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3721–3740 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 20 Aug 2026, 23:19 WIB

CVE-2026-18281

Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability

Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:19:20.513Z. Updated 2026-08-21T20:08:41.453Z.

CVSS8v3.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

LowPublished 20 Aug 2026, 23:19 WIB

CVE-2026-18280

Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability

Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3721 to 3740 of 12259.First page Next page

Severity low: primary CNA CVSS 3.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:19:11.676Z. Updated 2026-08-21T20:08:41.602Z.

CVSS3.9v3.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

HighPublished 20 Aug 2026, 23:19 WIB

CVE-2026-18279

Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability

Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:19:02.391Z. Updated 2026-08-21T20:08:41.751Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

LowPublished 20 Aug 2026, 23:18 WIB

CVE-2026-18278

Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability

Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:18:52.440Z. Updated 2026-08-21T20:08:41.900Z.

CVSS3.5v3.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

LowPublished 20 Aug 2026, 23:18 WIB

CVE-2026-64846

Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:18:06.729Z. Updated 2026-08-20T19:32:22.878Z.

CVSS2.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:32 WIB

Official record

HighPublished 20 Aug 2026, 23:16 WIB

CVE-2026-69183

Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:16:43.289Z. Updated 2026-08-20T17:14:13.680Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 00:14 WIB

Official record

HighPublished 20 Aug 2026, 23:15 WIB

CVE-2026-18274

Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability

Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:15:48.152Z. Updated 2026-08-21T20:08:42.055Z.

CVSS7.2v3.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

MedPublished 20 Aug 2026, 23:15 WIB

CVE-2026-77019

CodeAstro Apartment Visitor Management System forgotpw.php sql injection

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:15:09.116Z. Updated 2026-08-25T15:01:49.451Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:01 WIB

Official record

MedPublished 20 Aug 2026, 23:14 WIB

CVE-2026-18273

Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability

Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target syste…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:14:49.100Z. Updated 2026-08-21T20:08:42.204Z.

CVSS6.6v3.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:08 WIB

Official record

MedPublished 20 Aug 2026, 23:14 WIB

CVE-2026-18272

Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability

Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the startUpdatePro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:14:37.830Z. Updated 2026-08-26T19:48:29.217Z.

CVSS6.8v3.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 02:48 WIB

Official record

MedPublished 20 Aug 2026, 23:14 WIB

CVE-2026-18271

Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability

Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:14:28.528Z. Updated 2026-08-26T19:48:44.233Z.

CVSS6.8v3.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 02:48 WIB

Official record

HighPublished 20 Aug 2026, 23:14 WIB

CVE-2026-18270

Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability

Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in ord…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:14:15.245Z. Updated 2026-08-26T19:48:59.632Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 02:48 WIB

Official record

MedPublished 20 Aug 2026, 23:14 WIB

CVE-2026-18269

Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability

Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists withi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:14:07.024Z. Updated 2026-08-26T19:49:15.834Z.

CVSS6.8v3.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 02:49 WIB

Official record

HighPublished 20 Aug 2026, 23:13 WIB

CVE-2026-18268

Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability

Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:13:59.070Z. Updated 2026-08-26T19:49:31.459Z.

CVSS7v3.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 02:49 WIB

Official record

MedPublished 20 Aug 2026, 23:13 WIB

CVE-2026-71492

Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation. Relative traversal su…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:13:55.578Z. Updated 2026-08-20T17:11:10.125Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 00:11 WIB

Official record

MedPublished 20 Aug 2026, 23:13 WIB

CVE-2026-18267

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmw…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:13:51.813Z. Updated 2026-08-26T19:49:46.798Z.

CVSS6.8v3.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 02:49 WIB

Official record

CritPublished 20 Aug 2026, 23:13 WIB

CVE-2026-18265

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OSNEXUS QuantaStor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of Kapacit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:13:34.177Z. Updated 2026-08-26T19:50:02.042Z.

CVSS9.8v3.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 02:50 WIB

Official record

HighPublished 20 Aug 2026, 23:13 WIB

CVE-2026-18264

NoMachine getstat Command Injection Remote Code Execution Vulnerability

NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4000…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:13:11.390Z. Updated 2026-08-26T19:50:17.572Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 02:50 WIB

Official record

HighPublished 20 Aug 2026, 23:11 WIB

CVE-2026-54616

NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:11:54.192Z. Updated 2026-08-20T19:52:07.850Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:52 WIB

Official record

HighPublished 20 Aug 2026, 23:10 WIB

CVE-2026-54449

LangBot: Authenticated RCE Via MCP Configuration

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and argument…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T16:10:25.169Z. Updated 2026-08-21T21:47:30.890Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:47 WIB

Official record