Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3861–3880 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77082

n8n before 1.123.69 ReDoS via Filter and Switch Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or executi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:13.700Z. Updated 2026-08-21T16:42:34.601Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:42 WIB

Official record

MedPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77081

n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are attached, the node enfor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3861 to 3880 of 12259.First page Next page

Published 2026-08-20T11:21:13.006Z. Updated 2026-08-21T11:21:21.502Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:21 WIB

Official record

HighPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77080

n8n before 1.123.69 Arbitrary File Read and Write via Snowflake

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions. An authenticated user …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:12.357Z. Updated 2026-08-21T11:21:20.831Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:21 WIB

Official record

HighPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77079

n8n before 2.34.1 Authorization Bypass via Custom Role Deletion

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user hold…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:11.692Z. Updated 2026-08-25T14:30:49.241Z.

CVSS7.4v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:30 WIB

Official record

HighPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77077

n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:10.939Z. Updated 2026-08-21T11:21:19.488Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:21 WIB

Official record

HighPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77076

n8n before 1.123.69 Credential Leak via GraphQL Node Error

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live requ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:10.251Z. Updated 2026-08-21T16:43:12.650Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:43 WIB

Official record

HighPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77075

n8n before 1.123.69 Expression Injection via Resource Locator

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An authenticated member can stor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:09.583Z. Updated 2026-08-21T11:21:18.192Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:21 WIB

Official record

MedPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77074

n8n before 1.123.69 SSRF via Edit Image Node

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access local files.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:08.910Z. Updated 2026-08-21T11:21:17.551Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:21 WIB

Official record

MedPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77073

n8n before 2.34.1 Cross-Project Credential Access via MCP

n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references on workflows in dif…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:08.265Z. Updated 2026-08-25T14:27:51.234Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:27 WIB

Official record

HighPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77072

n8n before 1.123.69 Stored XSS via Form Completion Page

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An authenticated member c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:07.588Z. Updated 2026-08-21T11:21:16.263Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:21 WIB

Official record

HighPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77071

n8n before 1.123.69 PostgREST Filter Injection via Supabase

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:06.912Z. Updated 2026-08-21T16:43:50.851Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:43 WIB

Official record

HighPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77070

n8n before 1.123.69 NoSQL Injection via MongoDB Node

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query (e.g., via externally-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:06.262Z. Updated 2026-08-21T11:21:14.972Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:21 WIB

Official record

LowPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77069

n8n before 1.123.69 SSRF Protection Bypass via OAuth2

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no SSRF guard. A user with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:05.599Z. Updated 2026-08-21T11:21:14.301Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:21 WIB

Official record

HighPublished 20 Aug 2026, 18:21 WIB

CVE-2026-77068

n8n before 2.34.1 Remote Code Execution via Path Traversal

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:21:04.945Z. Updated 2026-08-25T14:26:48.904Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:26 WIB

Official record

MedPublished 20 Aug 2026, 18:05 WIB

CVE-2026-77067

Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:05:51.482Z. Updated 2026-09-24T14:19:37.576Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

MedPublished 20 Aug 2026, 18:05 WIB

CVE-2026-77066

Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects private and reserved ranges through the private-ip library, and cr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T11:05:50.791Z. Updated 2026-09-24T14:19:36.528Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

MedPublished 20 Aug 2026, 17:39 WIB

CVE-2026-73199

Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the `JOIN_OID` in the `ipa-enrollment` extended operation, a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T10:39:13.688Z. Updated 2026-08-20T13:50:10.301Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 20:50 WIB

Official record

CritPublished 20 Aug 2026, 17:39 WIB

CVE-2026-11861

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T10:39:08.025Z. Updated 2026-10-26T13:50:31.485Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:50 WIB

Official record

HighPublished 20 Aug 2026, 17:39 WIB

CVE-2026-73198

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) cond…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T10:39:00.713Z. Updated 2026-10-26T13:27:01.369Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:27 WIB

Official record

HighPublished 20 Aug 2026, 17:37 WIB

CVE-2026-13097

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service princip…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-20T10:37:55.464Z. Updated 2026-10-26T13:26:44.455Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 20:26 WIB

Official record