Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 301–320 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 31 Mar 2026, 03:11 WIB

CVE-2026-25627

nanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocket

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code path copies Remaining Leng…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T20:11:08.586Z. Updated 2026-03-31T19:09:34.784Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 02:09 WIB

Official record

MedPublished 31 Mar 2026, 02:45 WIB

CVE-2026-5150

code-projects Accounting System Parameter viewin_costumer.php sql injection

A security vulnerability has been detected in code-projects Accounting System 1.0. This issue affects some unknown processing of the file /viewin_costumer.php of the component Parameter Handler. Such manipulation of the argument cos_id leads to sql injection. The attack can be launched remotely. The exploit has been di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 301 to 320 of 6236.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:45:13.244Z. Updated 2026-03-31T14:16:59.045Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:16 WIB

Official record

MedPublished 31 Mar 2026, 02:45 WIB

CVE-2026-5148

YunaiV yudao-cloud page sql injection

A weakness has been identified in YunaiV yudao-cloud up to 2026.01. This vulnerability affects unknown code of the file /admin-api/system/mail-log/page. This manipulation of the argument toMail causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:45:10.473Z. Updated 2026-04-01T18:25:55.211Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 01:25 WIB

Official record

HighPublished 31 Mar 2026, 02:43 WIB

CVE-2026-32275

Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback parameter allows cross-origin script injection and API key theft. This issue has been patched in version 2.17.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:43:06.878Z. Updated 2026-04-01T18:24:07.476Z.

CVSS7.4v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 01:24 WIB

Official record

MedPublished 31 Mar 2026, 02:42 WIB

CVE-2026-31799

Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after" and from version 2.1.0-beta to before version 2.17.0 for parameters "section_id" and "user_id", the /api/v2?cmd=get_home_stats endpoint passes the section_id, u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:42:56.714Z. Updated 2026-03-30T20:17:35.823Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 03:17 WIB

Official record

HighPublished 31 Mar 2026, 02:42 WIB

CVE-2026-31831

Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:42:23.002Z. Updated 2026-03-31T19:09:40.491Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 02:09 WIB

Official record

MedPublished 31 Mar 2026, 02:42 WIB

CVE-2026-31804

Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme or host. The endpoin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:42:09.704Z. Updated 2026-04-01T18:22:21.837Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 01:22 WIB

Official record

HighPublished 31 Mar 2026, 02:41 WIB

CVE-2026-28505

Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.co_names of the compiled code objec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:41:54.644Z. Updated 2026-03-30T20:13:28.905Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 03:13 WIB

Official record

CritPublished 31 Mar 2026, 02:26 WIB

CVE-2026-33026

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:26:27.695Z. Updated 2026-03-31T14:17:48.298Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:17 WIB

Official record

HighPublished 31 Mar 2026, 02:07 WIB

CVE-2026-21710

CVE-2026-21710

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:07:28.558Z. Updated 2026-07-15T01:19:57.306Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:19 WIB

Official record

LowPublished 31 Mar 2026, 02:07 WIB

CVE-2026-21716

CVE-2026-21716

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:07:28.538Z. Updated 2026-03-31T14:27:23.323Z.

CVSS3.3v3.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:27 WIB

Official record

MedPublished 31 Mar 2026, 02:07 WIB

CVE-2026-21711

CVE-2026-21711

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:07:28.526Z. Updated 2026-04-01T15:03:21.612Z.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 22:03 WIB

Official record

LowPublished 31 Mar 2026, 02:07 WIB

CVE-2026-21715

CVE-2026-21715

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.na…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:07:28.507Z. Updated 2026-09-17T18:36:37.076Z.

CVSS3.3v3.0KEVNot listedEPSSPresentUpdated18 Sep 2026, 01:36 WIB

Official record

MedPublished 31 Mar 2026, 02:07 WIB

CVE-2026-21717

CVE-2026-21717

A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The mo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:07:28.415Z. Updated 2026-05-10T13:16:01.620Z.

CVSS5.9v3.0KEVNot listedEPSSPresentUpdated10 May 2026, 20:16 WIB

Official record

MedPublished 31 Mar 2026, 02:07 WIB

CVE-2026-21713

CVE-2026-21713

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:07:28.356Z. Updated 2026-05-10T13:17:50.281Z.

CVSS5.9v3.0KEVNot listedEPSSPresentUpdated10 May 2026, 20:17 WIB

Official record

MedPublished 31 Mar 2026, 02:07 WIB

CVE-2026-21714

CVE-2026-21714

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T19:07:28.317Z. Updated 2026-03-31T18:05:22.283Z.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:05 WIB

Official record

MedPublished 31 Mar 2026, 01:45 WIB

CVE-2026-5147

YunaiV yudao-cloud get-by-website sql injection

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T18:45:13.981Z. Updated 2026-10-26T16:08:55.213Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:08 WIB

Official record

CritPublished 31 Mar 2026, 01:27 WIB

CVE-2026-34714

CVE-2026-34714

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T18:27:55.752Z. Updated 2026-09-01T12:04:45.374Z.

CVSS9.2v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 19:04 WIB

Official record

HighPublished 31 Mar 2026, 01:27 WIB

CVE-2026-3991

Elevation of Privileges in Symantec Data Loss Prevention Windows Endpoint

Symantec Data Loss Prevention Windows Endpoint, prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 MP2 HF15, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resour…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T18:27:31.430Z. Updated 2026-03-31T13:49:39.341Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 20:49 WIB

Official record

HighKEVPublished 31 Mar 2026, 01:05 WIB

CVE-2026-3502

TrueConf Client Update Integrity Verification Bypass

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2026-03-30T18:05:42.806Z. Updated 2026-04-03T03:55:23.638Z.

CVSS7.8v3.1KEVListedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record