Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 301–320 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

HighPublished 29 May 2026, 17:49 WIB

CVE-2025-41268

CVE-2025-41268

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to delete arbitrary files on the Host machines.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T10:49:29.042Z. Updated 2026-05-29T13:41:30.693Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated29 May 2026, 20:41 WIB

Official record

HighPublished 29 May 2026, 17:48 WIB

CVE-2025-41267

CVE-2025-41267

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T10:48:51.842Z. Updated 2026-05-29T14:03:35.502Z.

Showing 301 to 320 of 6933.First page Next page

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 May 2026, 21:03 WIB

Official record

HighPublished 29 May 2026, 17:48 WIB

CVE-2025-41266

CVE-2025-41266

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T10:48:08.952Z. Updated 2026-05-29T14:33:46.968Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 May 2026, 21:33 WIB

Official record

MedPublished 29 May 2026, 17:41 WIB

CVE-2026-9811

CVE-2026-9811

A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T10:41:29.041Z. Updated 2026-05-29T14:34:13.971Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 May 2026, 21:34 WIB

Official record

HighPublished 29 May 2026, 17:41 WIB

CVE-2025-41265

CVE-2025-41265

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T10:41:12.429Z. Updated 2026-05-29T14:36:09.993Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 May 2026, 21:36 WIB

Official record

HighPublished 29 May 2026, 17:36 WIB

CVE-2026-9809

CVE-2026-9809

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T10:36:38.996Z. Updated 2026-05-29T14:39:42.198Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated29 May 2026, 21:39 WIB

Official record

HighPublished 29 May 2026, 17:30 WIB

CVE-2026-9808

CVE-2026-9808

An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or `editown`) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic control…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T10:30:23.561Z. Updated 2026-05-29T14:42:37.155Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated29 May 2026, 21:42 WIB

Official record

CritPublished 29 May 2026, 17:19 WIB

CVE-2026-9559

CVE-2026-9559

A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges (campaign:imports:create) can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T10:19:48.936Z. Updated 2026-05-29T14:53:24.102Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated29 May 2026, 21:53 WIB

Official record

CritPublished 29 May 2026, 17:01 WIB

CVE-2026-9558

CVE-2026-9558

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T10:01:36.019Z. Updated 2026-05-29T10:49:06.099Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated29 May 2026, 17:49 WIB

Official record

HighPublished 29 May 2026, 16:50 WIB

CVE-2026-42965

Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation

A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T09:50:44.429Z. Updated 2026-10-01T16:35:55.555Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 23:35 WIB

Official record

HighPublished 29 May 2026, 16:50 WIB

CVE-2026-46579

Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend

A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends rel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T09:50:44.351Z. Updated 2026-09-10T12:04:47.655Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated10 Sep 2026, 19:04 WIB

Official record

MedPublished 29 May 2026, 16:38 WIB

CVE-2026-9557

CVE-2026-9557

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T09:38:40.857Z. Updated 2026-05-29T10:51:10.746Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated29 May 2026, 17:51 WIB

Official record

LowPublished 29 May 2026, 16:30 WIB

CVE-2026-10078

Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T09:30:30.084Z. Updated 2026-05-29T18:27:39.192Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 01:27 WIB

Official record

MedPublished 29 May 2026, 16:28 WIB

CVE-2025-12714

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the update_site_editor_homepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to modify several plugin s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T09:28:06.406Z. Updated 2026-05-29T12:55:17.214Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 May 2026, 19:55 WIB

Official record

CritPublished 29 May 2026, 15:57 WIB

CVE-2026-49201

Acer Wave 7 router: Hardcoded Cryptographic Key

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T08:57:54.569Z. Updated 2026-05-29T10:53:32.056Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated29 May 2026, 17:53 WIB

Official record

CritPublished 29 May 2026, 15:51 WIB

CVE-2026-49200

Acer Wave 7 router: Broken Access Control

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T08:51:15.717Z. Updated 2026-05-29T10:54:23.855Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated29 May 2026, 17:54 WIB

Official record

CritPublished 29 May 2026, 15:38 WIB

CVE-2026-49199

Predator Connect W6x: RCE via MQTT

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T08:38:24.215Z. Updated 2026-05-29T10:55:30.188Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated29 May 2026, 17:55 WIB

Official record

MedPublished 29 May 2026, 15:37 WIB

CVE-2026-10058

ITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site Scripting

ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privileged remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T08:37:46.154Z. Updated 2026-05-29T11:02:06.658Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 May 2026, 18:02 WIB

Official record

MedPublished 29 May 2026, 15:34 WIB

CVE-2026-10057

ITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site Scripting

ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privileged remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T08:34:33.682Z. Updated 2026-05-29T11:04:28.735Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 May 2026, 18:04 WIB

Official record

HighPublished 29 May 2026, 15:30 WIB

CVE-2026-49198

Predator Connect W6x: MQTT Broker Access Control

Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T08:30:28.370Z. Updated 2026-05-29T11:15:34.673Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated29 May 2026, 18:15 WIB

Official record