Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates
5,813 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.
CVE-2026-37594
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_employee.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:28:50.725Z.
CVE-2026-37595
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_employee.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:28:38.905Z.
CVE-2026-37596
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_department.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:28:25.909Z.
CVE-2026-37597
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:27:12.818Z.
CVE-2026-37598
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettings.php?f=update_settings.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:26:27.302Z.
CVE-2026-37600
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:25:24.236Z.
CVE-2026-37601
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:25:09.200Z.
CVE-2026-37602
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:24:23.662Z.
CVE-2026-38526
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T17:50:54.198Z.
CVE-2026-38527
A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request.
Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T17:36:59.813Z.
CVE-2026-38528
Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T17:34:54.115Z.
CVE-2026-38529
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T17:31:13.560Z.
CVE-2026-38530
A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.
Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T17:28:56.838Z.
CVE-2026-38532
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.
Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T17:27:56.674Z.
CVE-2026-38533
An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-14T00:00:00.000Z. Updated 2026-04-16T12:06:16.556Z.
nimiq-consensus panics via RequestMacroChain micro-block locator
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. In versions 1.2.2 and below, an unauthenticated p2p peer can cause the RequestMacroChain message handler task to panic. Sending a RequestMacroChain message where the first locator hash on th…
Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-13T23:55:52.994Z. Updated 2026-04-14T16:28:14.091Z.
jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input
jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), …
Severity low: primary CNA CVSS 2.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-13T23:51:04.144Z. Updated 2026-04-14T15:53:38.340Z.
jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed
jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) wh…
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-13T23:40:12.693Z. Updated 2026-09-01T12:04:42.735Z.
Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks
Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuffer was used to store and compare plaintext passwords, then discrepencies in timing could be used to guess the secret password.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-13T22:54:53.724Z. Updated 2026-04-15T20:03:28.442Z.
User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient validation of user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. The `redirect_to_on_logout` GET parameter is passed di…
Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-13T22:25:54.316Z. Updated 2026-04-24T19:30:44.119Z.