Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 3821–3840 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 09 Apr 2026, 23:07 WIB

CVE-2026-39942

Directus has a Path Traversal and Broken Access Control in File Management API

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled filename_disk parameter. By setting this value to match the storage path of another user's file, an attacker can overwrite that file's content while manipulating me…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T16:07:54.100Z. Updated 2026-04-09T19:37:24.389Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated10 Apr 2026, 02:37 WIB

Official record

MedPublished 09 Apr 2026, 23:03 WIB

CVE-2026-39856

osslsigncode has an Out-of-Bounds Read via Unvalidated Section Bounds in PE Page Hash Calculation

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When processing PE sections for page hashing, the function uses PointerToRawData an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3821 to 3840 of 5813.First page Next page

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T16:03:28.233Z. Updated 2026-04-13T20:06:35.283Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 03:06 WIB

Official record

MedPublished 09 Apr 2026, 22:58 WIB

CVE-2026-39855

osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Read

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:58:38.559Z. Updated 2026-04-09T19:22:16.659Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated10 Apr 2026, 02:22 WIB

Official record

UnscoredPublished 09 Apr 2026, 22:58 WIB

CVE-2026-40046

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated

Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT. The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions. This issue aff…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:58:32.966Z. Updated 2026-04-10T19:41:00.618Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Apr 2026, 02:41 WIB

Official record

UnscoredPublished 09 Apr 2026, 22:52 WIB

CVE-2026-33005

Apache OpenMeetings: Insufficient checks in FileWebService

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at Fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:52:50.770Z. Updated 2026-04-10T18:44:45.976Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Apr 2026, 01:44 WIB

Official record

UnscoredPublished 09 Apr 2026, 22:52 WIB

CVE-2026-33266

Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt

Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get fu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:52:36.105Z. Updated 2026-04-10T18:49:13.351Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Apr 2026, 01:49 WIB

Official record

UnscoredPublished 09 Apr 2026, 22:52 WIB

CVE-2026-34020

Apache OpenMeetings: Login Credentials Passed via GET Query Parameters

Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0. Users ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:52:06.599Z. Updated 2026-04-10T20:13:47.789Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Apr 2026, 03:13 WIB

Official record

HighPublished 09 Apr 2026, 22:50 WIB

CVE-2026-39853

osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verification

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:50:26.548Z. Updated 2026-04-09T16:15:19.583Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:15 WIB

Official record

HighPublished 09 Apr 2026, 22:43 WIB

CVE-2026-39843

Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching

Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:43:34.963Z. Updated 2026-04-13T20:05:32.594Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 03:05 WIB

Official record

MedPublished 09 Apr 2026, 22:38 WIB

CVE-2026-39941

ChurchCRM has an XSS vulnerability

ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This vulner…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:38:07.444Z. Updated 2026-04-10T14:05:39.204Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated10 Apr 2026, 21:05 WIB

Official record

MedPublished 09 Apr 2026, 22:15 WIB

CVE-2026-5960

code-projects Patient Record Management System SQL Database Backup File hcpms.sql information disclosure

A weakness has been identified in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /db/hcpms.sql of the component SQL Database Backup File Handler. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made avai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:15:11.648Z. Updated 2026-04-10T14:04:51.221Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated10 Apr 2026, 21:04 WIB

Official record

HighPublished 09 Apr 2026, 22:06 WIB

CVE-2026-35205

Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:06:41.052Z. Updated 2026-07-15T01:02:59.773Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:02 WIB

Official record

LowPublished 09 Apr 2026, 22:03 WIB

CVE-2025-14551

Senstive information disclosure was affecting subiquity

In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.

Excerpt language: en.

Severity low: primary CNA CVSS 2.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:03:58.798Z. Updated 2026-04-10T13:54:40.369Z.

CVSS2.7v4.0KEVNot listedEPSSPresentUpdated10 Apr 2026, 20:54 WIB

Official record

HighPublished 09 Apr 2026, 22:03 WIB

CVE-2026-35204

Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem location. To prevent this, validate that the plugin.yaml of the Helm plugin does not include a version: fie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:03:28.668Z. Updated 2026-07-15T01:03:02.188Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:03 WIB

Official record

LowPublished 09 Apr 2026, 22:02 WIB

CVE-2025-15480

Senstive information disclosure was affecting ubuntu-desktop-provision

In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.

Excerpt language: en.

Severity low: primary CNA CVSS 2.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T15:02:14.066Z. Updated 2026-04-10T13:57:17.350Z.

CVSS2.7v4.0KEVNot listedEPSSPresentUpdated10 Apr 2026, 20:57 WIB

Official record

MedPublished 09 Apr 2026, 21:55 WIB

CVE-2026-35041

ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification

fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a cra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T14:55:22.807Z. Updated 2026-04-09T16:15:25.352Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:15 WIB

Official record

MedPublished 09 Apr 2026, 21:52 WIB

CVE-2026-35040

fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause fai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T14:52:56.436Z. Updated 2026-04-13T20:03:41.746Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 03:03 WIB

Official record

MedPublished 09 Apr 2026, 21:49 WIB

CVE-2026-4878

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T14:49:02.942Z. Updated 2026-10-14T19:09:01.922Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 02:09 WIB

Official record

UnscoredPublished 09 Apr 2026, 21:44 WIB

CVE-2026-5439

Memory Exhaustion via Forged ZIP Metadata

A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc automatically extracts ZIP archives uploaded to certain endpoints and trusts metadata fields describing the uncompressed size of archived files. An attacker can craft a small ZIP archive containing a forged size value, causing the server to all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T14:44:37.078Z. Updated 2026-04-14T16:34:14.439Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Apr 2026, 23:34 WIB

Official record

UnscoredPublished 09 Apr 2026, 21:44 WIB

CVE-2026-5437

Out-of-Bounds Read in DicomStreamReader

An out-of-bounds read vulnerability exists in `DicomStreamReader` during DICOM meta-header parsing. When processing malformed metadata structures, the parser may read beyond the bounds of the allocated metadata buffer. Although this issue does not typically crash the server or expose data directly to the attacker, it r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-09T14:44:17.972Z. Updated 2026-04-14T16:34:20.487Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Apr 2026, 23:34 WIB

Official record