Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 3121–3140 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 14 Apr 2026, 05:18 WIB

CVE-2026-39979

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T22:18:56.252Z. Updated 2026-07-15T01:01:40.651Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:01 WIB

Official record

MedPublished 14 Apr 2026, 05:10 WIB

CVE-2026-39956

jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure

jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3121 to 3140 of 5813.First page Next page

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T22:10:18.817Z. Updated 2026-09-04T13:29:32.969Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated04 Sep 2026, 20:29 WIB

Official record

HighPublished 14 Apr 2026, 04:52 WIB

CVE-2026-4786

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:52:19.036Z. Updated 2026-08-13T00:27:20.638Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated13 Aug 2026, 07:27 WIB

Official record

MedPublished 14 Apr 2026, 04:50 WIB

CVE-2026-33947

jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()

jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document contain…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:50:18.814Z. Updated 2026-04-16T03:03:39.478Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 10:03 WIB

Official record

MedPublished 14 Apr 2026, 04:43 WIB

CVE-2026-40312

ImageMagick: Off-by-One in MSL decoder could result in crash

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, an off by one error in the MSL decoder could result in a crash when a malicous MSL file is read. This issue has been fixed in version 7.1.2-19.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:43:28.416Z. Updated 2026-04-14T19:27:39.053Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 02:27 WIB

Official record

MedPublished 14 Apr 2026, 04:36 WIB

CVE-2026-40311

ImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing values

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profile. This issue has been fixed in versions 6.9.13-44 and 7.1.2-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:36:44.262Z. Updated 2026-04-14T15:48:36.521Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 22:48 WIB

Official record

MedPublished 14 Apr 2026, 04:32 WIB

CVE-2026-40310

ImageMagick: Heap out-of-bounds write in JP2 encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below both 7.1.2-19 and 6.9.13-44, contain a heap out-of-bounds write in the JP2 encoder with when a user specifies an invalid sampling index. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:32:53.361Z. Updated 2026-04-14T16:28:25.315Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 23:28 WIB

Official record

MedPublished 14 Apr 2026, 04:28 WIB

CVE-2026-40183

ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit float

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, the JXL encoder has an heap write overflow when a user specifies that the image should be encoded as 16 bit floats. This issue has been fixed in version 7.1.2-19.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:28:20.797Z. Updated 2026-04-14T19:27:39.187Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 02:27 WIB

Official record

CritPublished 14 Apr 2026, 04:28 WIB

CVE-2026-22563

CVE-2026-22563

A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play network. Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier)  UniFi Play Audio Port (Version 1.0.24 and earlier)  Mitigation: Update UniFi Play PowerAmp to Versio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:28:11.100Z. Updated 2026-04-14T13:14:19.586Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 20:14 WIB

Official record

CritPublished 14 Apr 2026, 04:28 WIB

CVE-2026-22562

CVE-2026-22562

A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to write files on the system that could be used for a remote code execution (RCE). Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier) UniFi Play Audio Port (Version 1.0.2…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:28:11.025Z. Updated 2026-04-14T13:14:19.709Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 20:14 WIB

Official record

HighPublished 14 Apr 2026, 04:28 WIB

CVE-2026-22566

CVE-2026-22566

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials.  Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier)  UniFi Play Audio Port (Version 1.0.24 and earlier)  Mitigation: Update UniFi Play PowerAmp to Ver…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:28:10.973Z. Updated 2026-04-14T13:14:19.836Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 20:14 WIB

Official record

UnscoredPublished 14 Apr 2026, 04:28 WIB

CVE-2026-22565

CVE-2026-22565

An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop responding.  Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier)  UniFi Play Audio Port (Version 1.0.24 and earlier)  Mitigation: Update UniFi Play PowerAmp to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:28:10.916Z. Updated 2026-04-14T20:18:31.138Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Apr 2026, 03:18 WIB

Official record

CritPublished 14 Apr 2026, 04:28 WIB

CVE-2026-22564

CVE-2026-22564

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the system.  Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier)  UniFi Play Audio Port (Version 1.0.24 and earlier)  Mitigation: Update UniFi P…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:28:10.865Z. Updated 2026-04-14T13:14:19.961Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 20:14 WIB

Official record

MedPublished 14 Apr 2026, 04:25 WIB

CVE-2026-40169

ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encoders

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, a crafted image could result in an out of bounds heap write when writing a yaml or json output, resulting in a crash. This issue has been fixed in version 7.1.2-19.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:25:56.317Z. Updated 2026-04-14T15:52:31.799Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 22:52 WIB

Official record

MedPublished 14 Apr 2026, 04:15 WIB

CVE-2026-6224

nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox

A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be initiated remotely. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:15:11.914Z. Updated 2026-04-14T16:28:30.809Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Apr 2026, 23:28 WIB

Official record

MedPublished 14 Apr 2026, 04:14 WIB

CVE-2026-34238

ImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit builds

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, an integer overflow in the despeckle operation causes a heap buffer overflow on 32-bit builds that will result in an out of bounds write. This issue has been fixed in versions 6.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:14:07.180Z. Updated 2026-04-14T13:46:39.542Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 20:46 WIB

Official record

HighPublished 14 Apr 2026, 04:06 WIB

CVE-2026-33908

ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an X…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:06:42.682Z. Updated 2026-07-15T01:05:22.443Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:05 WIB

Official record

MedPublished 14 Apr 2026, 04:02 WIB

CVE-2026-33905

ImageMagick has an Out-of-Bounds read via -sample operation

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the -sample operation has an out of bounds read when an specific offset is set through the `sample:offset` define that could lead to an out of bounds read. This issue has been fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:02:58.121Z. Updated 2026-04-16T13:26:40.363Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 20:26 WIB

Official record

MedPublished 14 Apr 2026, 04:00 WIB

CVE-2026-6220

HummerRisk Video File Download URL ServerService.java ServerService.addServer server-side request forgery

A vulnerability was identified in HummerRisk up to 1.5.0. This vulnerability affects the function ServerService.addServer of the file ServerService.java of the component Video File Download URL Handler. Such manipulation of the argument streamIp leads to server-side request forgery. It is possible to launch the attack …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T21:00:14.084Z. Updated 2026-04-14T13:45:56.944Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated14 Apr 2026, 20:45 WIB

Official record

MedPublished 14 Apr 2026, 03:59 WIB

CVE-2026-33902

ImageMagick: Stack Overflow via Recursive FX Expression Parsing

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a stack overflow vulnerability in ImageMagick's FX expression parser allows an attacker to crash the process by providing a deeply nested expression. This issue has been fixed in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-13T20:59:47.120Z. Updated 2026-04-14T15:51:26.551Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 22:51 WIB

Official record