Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 301–320 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

CritPublished 30 Sep 2026, 22:14 WIB

CVE-2026-102427

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T15:14:49.229Z. Updated 2026-09-30T16:09:54.660Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:09 WIB

Official record

MedPublished 30 Sep 2026, 21:53 WIB

CVE-2026-94545

Satori-generated SVG has improper escaping

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 301 to 320 of 14934.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:53:34.961Z. Updated 2026-09-30T15:48:41.962Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:48 WIB

Official record

HighPublished 30 Sep 2026, 21:48 WIB

CVE-2026-103398

OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:48:57.725Z. Updated 2026-10-01T14:50:05.631Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 21:50 WIB

Official record

MedPublished 30 Sep 2026, 21:48 WIB

CVE-2026-103397

OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access prote…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:48:57.063Z. Updated 2026-10-02T16:19:36.553Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 23:19 WIB

Official record

MedPublished 30 Sep 2026, 21:48 WIB

CVE-2026-103396

bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the sy…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:48:56.405Z. Updated 2026-09-30T16:57:55.383Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:57 WIB

Official record

CritPublished 30 Sep 2026, 21:48 WIB

CVE-2026-103395

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service

LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service accoun…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:48:55.734Z. Updated 2026-09-30T19:38:06.768Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:38 WIB

Official record

HighPublished 30 Sep 2026, 21:48 WIB

CVE-2026-103270

LightLLM through 1.2.0 Missing Authentication on RL Control Routes

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments sta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:48:55.071Z. Updated 2026-09-30T16:00:02.085Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:00 WIB

Official record

MedPublished 30 Sep 2026, 21:48 WIB

CVE-2026-103243

LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints

LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:48:54.414Z. Updated 2026-10-02T16:17:56.167Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 23:17 WIB

Official record

CritPublished 30 Sep 2026, 21:47 WIB

CVE-2026-76570

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:47:48.516Z. Updated 2026-09-30T16:10:53.173Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:10 WIB

Official record

HighPublished 30 Sep 2026, 21:35 WIB

CVE-2026-102984

Astro: Malformed port in the Host header can crash the Node adapter

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing begins. In the default…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:35:22.323Z. Updated 2026-09-30T19:39:28.485Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:39 WIB

Official record

MedPublished 30 Sep 2026, 21:32 WIB

CVE-2026-102983

Astro: Netlify Image CDN allowlist bypass enables SSRF

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin app…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:32:03.861Z. Updated 2026-09-30T16:24:47.048Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:24 WIB

Official record

UnscoredPublished 30 Sep 2026, 21:31 WIB

CVE-2026-102717

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:31:22.786Z. Updated 2026-09-30T20:00:26.657Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:00 WIB

Official record

HighPublished 30 Sep 2026, 21:31 WIB

CVE-2026-47097

AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly available firmware image …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:31:11.797Z. Updated 2026-09-30T22:00:40.080Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 05:00 WIB

Official record

MedPublished 30 Sep 2026, 21:30 WIB

CVE-2026-103227

GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:30:09.232Z. Updated 2026-10-02T16:16:01.069Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 23:16 WIB

Official record

MedPublished 30 Sep 2026, 21:25 WIB

CVE-2026-103389

MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph

MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated directly into HTML markup b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:25:59.230Z. Updated 2026-09-30T15:28:06.728Z.

CVSS6.2v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

MedPublished 30 Sep 2026, 21:22 WIB

CVE-2026-103388

MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: U…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:22:36.271Z. Updated 2026-09-30T15:28:06.980Z.

CVSS6.2v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

CritPublished 30 Sep 2026, 21:15 WIB

CVE-2026-18782

SQL Injection in Trex Digital Manufacturing's Trex MES

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:15:15.056Z. Updated 2026-09-30T15:28:07.132Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

MedPublished 30 Sep 2026, 21:15 WIB

CVE-2026-103226

Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow

A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:15:06.241Z. Updated 2026-10-15T16:16:29.137Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Oct 2026, 23:16 WIB

Official record

HighPublished 30 Sep 2026, 21:12 WIB

CVE-2026-18783

Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES

Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:12:02.320Z. Updated 2026-09-30T15:28:07.269Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

MedPublished 30 Sep 2026, 21:10 WIB

CVE-2026-97259

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:10:24.653Z. Updated 2026-09-30T15:28:07.426Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record