Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 3101–3120 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 18 Mar 2026, 06:43 WIB

CVE-2026-27811

Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the `/config/compare/<service>/<server_ip>/show` endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T23:43:05.871Z. Updated 2026-03-18T19:53:19.520Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 02:53 WIB

Official record

HighPublished 18 Mar 2026, 06:34 WIB

CVE-2026-27459

pyOpenSSL DTLS cookie callback buffer overflow

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3101 to 3120 of 6236.First page Next page

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T23:34:28.483Z. Updated 2026-09-11T12:09:00.415Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated11 Sep 2026, 19:09 WIB

Official record

MedPublished 18 Mar 2026, 06:32 WIB

CVE-2026-4355

Portabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T23:32:14.049Z. Updated 2026-03-18T20:19:52.541Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:19 WIB

Official record

MedPublished 18 Mar 2026, 06:32 WIB

CVE-2026-4354

TRENDnet TEW-824DRU Web apply_sec.cgi sub_420A78 cross site scripting

A vulnerability was identified in TRENDnet TEW-824DRU 1.010B01/1.04B01. The impacted element is the function sub_420A78 of the file apply_sec.cgi of the component Web Interface. Such manipulation of the argument Language leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T23:32:11.394Z. Updated 2026-03-18T20:19:29.923Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:19 WIB

Official record

LowPublished 18 Mar 2026, 06:24 WIB

CVE-2026-27448

pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T23:24:30.661Z. Updated 2026-03-18T20:18:08.768Z.

CVSS1.7v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:18 WIB

Official record

MedPublished 18 Mar 2026, 06:21 WIB

CVE-2026-26004

Sentry allows unauthorized access to event data across organizational boundaries

Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organization Insecure Direct Object Reference (IDOR) vulnerability in Sentry's GroupEventJsonView endpoint. Version 26.1.0 patches the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T23:21:35.460Z. Updated 2026-03-18T20:17:22.669Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:17 WIB

Official record

HighPublished 18 Mar 2026, 06:18 WIB

CVE-2026-26001

GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T23:18:01.387Z. Updated 2026-03-18T20:16:53.878Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:16 WIB

Official record

MedPublished 18 Mar 2026, 06:16 WIB

CVE-2026-25937

GLPI has a MFA bypass

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T23:16:38.069Z. Updated 2026-03-19T03:55:19.142Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 10:55 WIB

Official record

HighPublished 18 Mar 2026, 05:45 WIB

CVE-2026-22727

Cloud Foundry unprotected internal endpoints

Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has bypassed the firewall to potentially replace droplets and therefore applications allowing them to access secure application information.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T22:45:09.247Z. Updated 2026-03-19T03:55:20.318Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 10:55 WIB

Official record

CritPublished 18 Mar 2026, 05:43 WIB

CVE-2026-21994

CVE-2026-21994

Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects (component: Desktop). The supported version that is affected is 0.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Edge…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T22:43:25.418Z. Updated 2026-03-18T14:33:31.192Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated18 Mar 2026, 21:33 WIB

Official record

HighPublished 18 Mar 2026, 05:41 WIB

CVE-2026-1264

IBM Sterling B2B Integrator and IBM Sterling File Gateway Improper Access Controls

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 allows a remote unauthenticated attacker to view and delete the partners of a community and to delete the communities.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T22:41:42.874Z. Updated 2026-03-18T20:15:57.388Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:15 WIB

Official record

HighPublished 18 Mar 2026, 05:41 WIB

CVE-2025-14031

IBM Sterling B2B Integrator and IBM Sterling File Gateway Denial of Service

IBM Sterling B2B Integrator and and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 could allow an unauthenticated attacker to send a specially crafted request that causes the application to crash.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T22:41:41.536Z. Updated 2026-03-18T20:15:38.036Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:15 WIB

Official record

UnscoredPublished 18 Mar 2026, 05:29 WIB

CVE-2026-20643

CVE-2026-20643

A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T22:29:48.227Z. Updated 2026-10-26T20:40:02.537Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Oct 2026, 03:40 WIB

Official record

MedPublished 18 Mar 2026, 05:20 WIB

CVE-2026-3856

IBM Db2 Recovery Expert Missing Integrity Check

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integrity of the data during transmission.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T22:20:14.968Z. Updated 2026-03-18T20:15:13.762Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:15 WIB

Official record

HighPublished 18 Mar 2026, 04:53 WIB

CVE-2026-1376

IBM i Denial of Service

IBM i 7.6 could allow a remote attacker to cause a denial of service using failed authentication connections due to improper allocation of resources.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T21:53:44.108Z. Updated 2026-03-18T20:01:11.954Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:01 WIB

Official record

MedPublished 18 Mar 2026, 04:50 WIB

CVE-2026-1267

IBM Planning Analytics Information Disclosure

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T21:50:24.914Z. Updated 2026-03-18T14:57:13.447Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Mar 2026, 21:57 WIB

Official record

MedPublished 18 Mar 2026, 04:50 WIB

CVE-2025-14806

IBM Planning Analytics Information Disclosure

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T21:50:21.639Z. Updated 2026-03-18T14:49:19.048Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated18 Mar 2026, 21:49 WIB

Official record

HighPublished 18 Mar 2026, 04:42 WIB

CVE-2026-32838

Edimax GS-5008PL <= 1.00.54 Transmits Credentials Over Cleartext HTTP

Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without implementing TLS or SSL encryption. Attackers on the same network can intercept management traffic to capture administrator credentials and sensitive configuration data.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T21:42:35.770Z. Updated 2026-08-14T16:49:42.101Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record

MedPublished 18 Mar 2026, 04:42 WIB

CVE-2026-32839

Edimax GS-5008PL <= 1.00.54 CSRF via Management CGI Endpoints

Edimax GS-5008PL firmware version 1.00.54 and prior contain a cross-site request forgery vulnerability that allows remote attackers to perform unauthorized administrative actions by inducing logged-in administrators to visit malicious pages. Attackers can exploit the lack of anti-CSRF tokens and request validation to c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T21:42:21.807Z. Updated 2026-08-14T16:49:42.756Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record

MedPublished 18 Mar 2026, 04:42 WIB

CVE-2026-32840

Edimax GS-5008PL <= 1.00.54 Stored XSS via Device Name

Edimax GS-5008PL firmware version 1.00.54 and prior contain a stored cross-site scripting vulnerability in the system_name_set.cgi script that allows attackers to inject arbitrary script code by manipulating the sysName parameter. Attackers can send a crafted POST request with malicious script payload that executes whe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T21:42:08.065Z. Updated 2026-08-14T16:49:43.406Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record