Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 3121–3140 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 18 Mar 2026, 04:41 WIB

CVE-2026-32842

Edimax GS-5008PL <= 1.00.54 Admin Credentials Stored in Cleartext

Edimax GS-5008PL firmware version 1.00.54 and prior contain an insecure credential storage vulnerability that allows attackers to obtain administrator credentials by accessing configuration backup files. Attackers can download the config.bin file through fupload.cgi to extract plaintext username and password fields for…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T21:41:55.905Z. Updated 2026-08-14T16:49:44.737Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record

CritPublished 18 Mar 2026, 04:41 WIB

CVE-2026-32841

Edimax GS-5008PL <= 1.00.54 Global Authentication State Across All Clients

Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the management interface. Attackers can exploit the global authentication flag mechanism to gain administrative access without credentials after any user authenticates, ena…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3121 to 3140 of 6236.First page Next page

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T21:41:28.349Z. Updated 2026-08-14T16:49:44.073Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record

MedPublished 18 Mar 2026, 04:32 WIB

CVE-2026-4349

Duende IdentityServer4 Token Renewal Endpoint authorize improper authentication

A vulnerability was determined in Duende IdentityServer4 up to 4.1.2. The affected element is an unknown function of the file /connect/authorize of the component Token Renewal Endpoint. This manipulation of the argument id_token_hint causes improper authentication. It is possible to initiate the attack remotely. The at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T21:32:11.670Z. Updated 2026-03-25T10:56:05.955Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated25 Mar 2026, 17:56 WIB

Official record

MedPublished 18 Mar 2026, 03:20 WIB

CVE-2026-2809

Endpoint DLP Driver DLL

Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow a privileged user to trigger an integer overflow within the DLL Injector, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T20:20:18.698Z. Updated 2026-03-18T19:59:38.332Z.

CVSS6.7v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 02:59 WIB

Official record

LowPublished 18 Mar 2026, 02:42 WIB

CVE-2026-4359

Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.

Excerpt language: en.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T19:42:03.476Z. Updated 2026-03-18T20:00:06.747Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:00 WIB

Official record

MedPublished 18 Mar 2026, 02:41 WIB

CVE-2026-25936

GLPI Vulnerable to Authenticated SQL Injection

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T19:41:32.444Z. Updated 2026-03-18T20:00:30.055Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 03:00 WIB

Official record

HighPublished 18 Mar 2026, 02:33 WIB

CVE-2026-32981

Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static dir…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T19:33:50.107Z. Updated 2026-10-08T15:22:30.099Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

UnscoredPublished 18 Mar 2026, 02:15 WIB

CVE-2026-3563

CVE-2026-3563

Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T19:15:37.820Z. Updated 2026-03-17T20:04:00.419Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Mar 2026, 03:04 WIB

Official record

UnscoredPublished 18 Mar 2026, 02:14 WIB

CVE-2026-4064

CVE-2026-4064

Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and disrupting service oper…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T19:14:17.189Z. Updated 2026-03-17T20:03:19.106Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Mar 2026, 03:03 WIB

Official record

HighPublished 18 Mar 2026, 02:11 WIB

CVE-2026-4295

Arbitrary code execution via crafted project files in Kiro IDE

Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory. To remediate this …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T19:11:58.702Z. Updated 2026-03-18T14:07:58.063Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated18 Mar 2026, 21:07 WIB

Official record

MedPublished 18 Mar 2026, 02:10 WIB

CVE-2026-32836

mackron / dr_libs dr_flac.h Excessive Memory Allocation in PICTURE Metadata Parsing

dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac__read_and_decode_metadata() that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit att…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T19:10:19.404Z. Updated 2026-07-28T01:48:36.035Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:48 WIB

Official record

MedPublished 18 Mar 2026, 02:10 WIB

CVE-2026-32837

mackron / miniaudio Out-of-Bounds Read in BEXT Coding History Parsing

miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T19:10:06.080Z. Updated 2026-07-14T18:39:58.052Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:39 WIB

Official record

MedPublished 18 Mar 2026, 02:00 WIB

CVE-2026-4358

Memory safety issues in slot-based execution hash table spill

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T19:00:07.518Z. Updated 2026-03-17T20:08:24.920Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated18 Mar 2026, 03:08 WIB

Official record

MedPublished 18 Mar 2026, 01:55 WIB

CVE-2025-15584

Endpoint DLP Driver Filter Communication Port Integer Overflow

Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an integer overflow within the filter communication port, leading to a Blue-Screen-of-Death (BSOD). Successful explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T18:55:59.156Z. Updated 2026-03-18T14:04:02.449Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated18 Mar 2026, 21:04 WIB

Official record

HighPublished 18 Mar 2026, 01:52 WIB

CVE-2025-66342

CVE-2025-66342

A type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T18:52:52.871Z. Updated 2026-03-18T17:00:08.764Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 00:00 WIB

Official record

MedPublished 18 Mar 2026, 01:52 WIB

CVE-2025-62500

CVE-2025-62500

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T18:52:51.039Z. Updated 2026-03-18T17:00:09.987Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 00:00 WIB

Official record

MedPublished 18 Mar 2026, 01:52 WIB

CVE-2025-61979

CVE-2025-61979

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T18:52:49.619Z. Updated 2026-03-18T17:00:10.924Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 00:00 WIB

Official record

MedPublished 18 Mar 2026, 01:52 WIB

CVE-2025-64733

CVE-2025-64733

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T18:52:48.001Z. Updated 2026-03-18T17:00:11.883Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 00:00 WIB

Official record

MedPublished 18 Mar 2026, 01:52 WIB

CVE-2025-66000

CVE-2025-66000

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T18:52:46.604Z. Updated 2026-03-18T17:00:14.138Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 00:00 WIB

Official record

HighPublished 18 Mar 2026, 01:52 WIB

CVE-2025-64301

CVE-2025-64301

An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out‑of‑bounds write, potentially leading to code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-17T18:52:44.900Z. Updated 2026-03-18T17:00:12.919Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated19 Mar 2026, 00:00 WIB

Official record