Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 3061–3080 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 18 Mar 2026, 08:34 WIB

CVE-2026-22174

OpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP Probe

OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to capture the Gateway authentication token. An attacker controlling a loopback port can intercept CDP reachability probes to the /json/version endpoint and reuse …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:34:20.043Z. Updated 2026-06-23T16:13:47.683Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:13 WIB

Official record

HighPublished 18 Mar 2026, 08:34 WIB

CVE-2026-22171

OpenClaw < 2026.2.19 - Path Traversal in Feishu Media Temporary File Naming

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal seg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3061 to 3080 of 6236.First page Next page

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:34:19.103Z. Updated 2026-06-23T16:13:46.994Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:13 WIB

Official record

MedPublished 18 Mar 2026, 08:34 WIB

CVE-2026-22170

OpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom Configuration

OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration causes dmPolicy pairing and allowlist restrictions to be ineffective. Remote attackers can send direct messages to BlueBubbles accounts by exploiting the misconfig…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:34:18.300Z. Updated 2026-06-23T16:13:46.295Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:13 WIB

Official record

HighPublished 18 Mar 2026, 08:34 WIB

CVE-2026-22169

OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option. When sort is explicitly added to tools.exec.safeBins, remote attackers can bypass intended safe-bin approval constraints by l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:34:17.508Z. Updated 2026-06-23T16:13:45.592Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:13 WIB

Official record

HighPublished 18 Mar 2026, 08:34 WIB

CVE-2026-22168

OpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.run

OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign command. Attackers can smuggle malicious arguments through cmd.exe /c to achieve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:34:16.700Z. Updated 2026-06-23T16:13:44.902Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:13 WIB

Official record

MedPublished 18 Mar 2026, 08:24 WIB

CVE-2026-4268

WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpgmza_custom_js’ parameter in all versions up to, and including, 10.0.05 due to insufficient input sanitization and output escaping and missing capability check in the 'admin_post_wpgmza_save_settings' h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:24:48.418Z. Updated 2026-04-08T17:26:06.798Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:26 WIB

Official record

MedPublished 18 Mar 2026, 08:19 WIB

CVE-2026-28499

LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:19:36.122Z. Updated 2026-03-18T14:08:06.611Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Mar 2026, 21:08 WIB

Official record

HighPublished 18 Mar 2026, 08:15 WIB

CVE-2026-28500

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading model…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:15:07.644Z. Updated 2026-07-15T01:11:41.016Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:11 WIB

Official record

HighPublished 18 Mar 2026, 08:14 WIB

CVE-2026-2603

Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, lea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:14:53.540Z. Updated 2026-07-15T01:15:28.491Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:15 WIB

Official record

HighPublished 18 Mar 2026, 08:14 WIB

CVE-2026-2092

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:14:48.364Z. Updated 2026-10-06T16:58:48.805Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated06 Oct 2026, 23:58 WIB

Official record

MedPublished 18 Mar 2026, 08:02 WIB

CVE-2026-4356

itsourcecode University Management System add_result.php cross site scripting

A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /add_result.php. Executing a manipulation of the argument vr can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T01:02:10.804Z. Updated 2026-03-18T14:11:41.455Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated18 Mar 2026, 21:11 WIB

Official record

HighPublished 18 Mar 2026, 07:48 WIB

CVE-2026-28674

xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the `AdminPaymentPluginUpload` endpoint lets admins upload any file to `plugins/payment/`. It only checks a hardcoded password (`qweasd123456`) and ignores file content. A background watcher…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T00:48:39.652Z. Updated 2026-03-18T14:34:00.955Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated18 Mar 2026, 21:34 WIB

Official record

HighPublished 18 Mar 2026, 07:41 WIB

CVE-2026-28673

xiaoheiFS Vulnerable to RCE via Unrestricted Plugin Installation (Manifest Manipulation)

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a `manifest.json`. The server trusts the `binaries` field in the manifest and executes the specified fil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T00:41:35.055Z. Updated 2026-03-18T14:34:38.632Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated18 Mar 2026, 21:34 WIB

Official record

MedPublished 18 Mar 2026, 07:30 WIB

CVE-2026-29057

Next.js: HTTP request smuggling in rewrites

Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement betwe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T00:30:27.738Z. Updated 2026-03-18T14:47:25.258Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated18 Mar 2026, 21:47 WIB

Official record

MedPublished 18 Mar 2026, 07:23 WIB

CVE-2026-27980

Next.js: Unbounded next/image disk cache growth can exhaust storage

Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimiz…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T00:23:34.862Z. Updated 2026-03-18T19:50:12.877Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 02:50 WIB

Official record

MedPublished 18 Mar 2026, 07:13 WIB

CVE-2026-27979

Next.js: Unbounded postponed resume buffering can lead to DoS

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the `next-resume: 1` header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing `maxPostponedStateSize` in certain setups. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T00:13:29.748Z. Updated 2026-03-18T19:51:36.190Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 02:51 WIB

Official record

UnscoredPublished 18 Mar 2026, 07:00 WIB

CVE-2025-55040

CVE-2025-55040

The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vulnerable cForm.importform function lacks CSRF token validation, enabling malicious websites to forge file upload requests that install attacker-controlled forms wh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T00:00:00.000Z. Updated 2026-03-18T20:24:57.832Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:24 WIB

Official record

UnscoredPublished 18 Mar 2026, 07:00 WIB

CVE-2025-55041

CVE-2025-55041

MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any user to any group without proper authorization checks. The vulnerable function lacks CSRF token validation and directly pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T00:00:00.000Z. Updated 2026-03-19T13:42:30.193Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2026, 20:42 WIB

Official record

UnscoredPublished 18 Mar 2026, 07:00 WIB

CVE-2025-55043

CVE-2025-55043

MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible directories. This vulnerability enables complete d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T00:00:00.000Z. Updated 2026-03-19T13:46:12.835Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2026, 20:46 WIB

Official record

UnscoredPublished 18 Mar 2026, 07:00 WIB

CVE-2025-55044

CVE-2025-55044

The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CSRF. The vulnerable cTrash.restore function lacks CSRF token validation, enabling malicious websites to forge requests that restore content to arbitrary parent lo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-18T00:00:00.000Z. Updated 2026-03-19T13:51:44.064Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2026, 20:51 WIB

Official record