Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 381–400 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41392

OpenClaw < 2026.3.31 - Exec Allowlist Bypass via Shell Init-File Options

OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations. Attackers can exploit shell options like --rcfile, --init-file, and --startup-file to load attacker-chosen initialization files while bypassing exec allowlist …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:52.716Z. Updated 2026-04-29T12:18:18.101Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:18 WIB

Official record

MedPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41391

OpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL Handling

OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate package management operations by injecting malicious index URLs …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 381 to 400 of 5813.First page Next page

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:51.901Z. Updated 2026-04-29T15:11:14.492Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 22:11 WIB

Official record

HighPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41390

OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper

OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:50.998Z. Updated 2026-04-29T19:26:39.243Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 02:26 WIB

Official record

MedPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41388

OpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling

OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers can restart the application to rehydrate revoked Tlon configuration from file state, bypassing intended revocation controls.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:50.281Z. Updated 2026-04-29T13:31:39.810Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:31 WIB

Official record

HighPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41387

OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitization

OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:49.570Z. Updated 2026-04-30T12:50:50.254Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 19:50 WIB

Official record

CritPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41386

OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:48.856Z. Updated 2026-04-29T12:49:41.640Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:49 WIB

Official record

HighPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41385

OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass

OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:48.017Z. Updated 2026-04-29T12:18:51.348Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:18 WIB

Official record

HighPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41384

OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend

OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace configs to inject arbitrary environment variables into the backend process…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:46.894Z. Updated 2026-04-29T15:11:21.165Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 22:11 WIB

Official record

MedPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41383

OpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths

OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can manipulate these OpenShell config paths to cause mirror sync operations to d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:46.122Z. Updated 2026-04-29T19:51:29.356Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 02:51 WIB

Official record

LowPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41382

OpenClaw < 2026.3.31 - Discord Voice Ingress Authorization Bypass via Channel and Role Validation Gaps

OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist restrictions. Attackers can exploit stale-role validation gaps and improper channel name validation to gain unauthorized access to restricted voice channels.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:45.177Z. Updated 2026-04-29T13:33:15.047Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:33 WIB

Official record

LowPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41381

OpenClaw < 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist

OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allowlist restrictions. Attackers can send Discord voice ingress requests before channel allowlist authorization is performed, gaining unauthorized access to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:44.214Z. Updated 2026-04-29T14:30:09.873Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 21:30 WIB

Official record

HighPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41380

OpenClaw < 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables

OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targets. Attackers can exploit positional carrier executable routing through dispatch wrappers to establish broader allowlist…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:43.488Z. Updated 2026-04-29T12:45:49.537Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:45 WIB

Official record

HighPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41379

OpenClaw < 2026.3.28 - Privilege Escalation via chat.send to Admin-Class Talk Voice Config

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice configuration persistence. Attackers with operator.write privileges can exploit the chat.send endpoint to reach and modify sensitive voice configuration settin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:42.687Z. Updated 2026-04-29T12:19:25.183Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:19 WIB

Official record

HighPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41378

OpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch

OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted agent.request dispatch to achie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:41.664Z. Updated 2026-04-29T15:11:28.154Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 22:11 WIB

Official record

MedPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41377

OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:40.607Z. Updated 2026-04-29T19:54:20.974Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Apr 2026, 02:54 WIB

Official record

LowPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41376

OpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation

OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to properly validate message senders. Attackers can fetch thread-root and reply context messages that should be filtered by sender allowlists, bypassing access controls.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:39.883Z. Updated 2026-04-29T13:33:51.478Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:33 WIB

Official record

HighPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41375

OpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin scope checks for external channels. Attackers can bypass authentication restrictions to arm or disarm phone channels without proper administrative privileg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:39.000Z. Updated 2026-04-29T14:27:37.027Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 21:27 WIB

Official record

MedPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41374

OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization

OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume resources. Remote attackers can trigger audio preflight processing without member allowlist validation to cause resource exhaustion.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:38.147Z. Updated 2026-04-29T12:43:13.810Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:43 WIB

Official record

MedPublished 29 Apr 2026, 01:09 WIB

CVE-2026-41373

OpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution Policy

OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted models to substitute CC, CXX, CARGO_BUILD_RUSTC, and CMAKE_C_COMPILER via environment overrides. Attackers with approved host-exec requests can override compile…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:09:36.986Z. Updated 2026-04-29T12:20:13.224Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:20 WIB

Official record

MedPublished 29 Apr 2026, 01:00 WIB

CVE-2026-7294

SourceCodester Pizzafy Ecommerce System index.php save_settings cross site scripting

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save_settings of the file /admin/index.php?page=save_settings. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been published and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-28T18:00:13.486Z. Updated 2026-04-29T14:25:57.343Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 21:25 WIB

Official record