Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 3121–3140 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 23 Oct 2026, 07:00 WIB

CVE-2026-50787

CVE-2026-50787

e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CP…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T00:00:00.000Z. Updated 2026-10-26T17:37:58.399Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:37 WIB

Official record

UnscoredPublished 23 Oct 2026, 07:00 WIB

CVE-2026-52356

CVE-2026-52356

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T00:00:00.000Z. Updated 2026-10-29T12:11:29.441Z.

Showing 3121 to 3140 of 16156.First page Next page

CVSS—

KEVNot listed

EPSSPresent

Updated29 Oct 2026, 19:11 WIB

Official record

MedPublished 23 Oct 2026, 06:45 WIB

CVE-2026-115534

gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modules/web/controllers/contact.php of the component Contact Form. Executing a manipulation of the argument nama/email/alamat/telepon/pesan can lead to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T23:45:15.462Z. Updated 2026-10-23T21:06:00.059Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 04:06 WIB

Official record

HighPublished 23 Oct 2026, 05:11 WIB

CVE-2026-110825

Kiloview E3 NDI Encoder Missing Authentication for Critical Function

The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T22:11:55.815Z. Updated 2026-10-23T10:56:08.479Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

HighPublished 23 Oct 2026, 05:09 WIB

CVE-2026-92450

Kiloview E3 NDI Encoder Use of Hard-coded Credentials

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T22:09:58.517Z. Updated 2026-10-22T22:09:58.517Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 05:09 WIB

Official record

CritPublished 23 Oct 2026, 05:06 WIB

CVE-2026-110243

Kiloview E3 NDI Encoder OS Command Injection

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permissi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T22:06:36.699Z. Updated 2026-10-23T10:56:08.635Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

CritPublished 23 Oct 2026, 05:04 WIB

CVE-2026-107861

Kiloview E3 NDI Encoder OS Command Injection

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T22:04:32.969Z. Updated 2026-10-23T10:56:08.780Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

MedPublished 23 Oct 2026, 05:01 WIB

CVE-2026-110491

Kiloview E3 NDI Encoder NULL Pointer Dereference

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T22:01:45.996Z. Updated 2026-10-23T10:56:08.939Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

MedPublished 23 Oct 2026, 04:58 WIB

CVE-2026-105265

Kiloview E3 NDI Encoder Path Traversal

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory .

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:58:34.789Z. Updated 2026-10-23T10:56:09.090Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

HighPublished 23 Oct 2026, 04:55 WIB

CVE-2026-96616

Kiloview E3 NDI Encoder Insufficient Session Expiration

Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:55:57.136Z. Updated 2026-10-23T10:56:09.232Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

MedPublished 23 Oct 2026, 04:53 WIB

CVE-2026-111100

Kiloview E3 NDI Encoder Missing Authentication for Critical Function

The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:53:44.787Z. Updated 2026-10-23T10:56:09.381Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

CritPublished 23 Oct 2026, 04:50 WIB

CVE-2026-109122

Kiloview E3 NDI Encoder OS Command Injection

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:50:47.777Z. Updated 2026-10-23T10:56:09.531Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

CritPublished 23 Oct 2026, 04:44 WIB

CVE-2026-110063

VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:44:42.868Z. Updated 2026-10-29T15:08:17.685Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:08 WIB

Official record

CritPublished 23 Oct 2026, 04:44 WIB

CVE-2026-83938

Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:44:42.272Z. Updated 2026-10-29T15:08:17.239Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:08 WIB

Official record

HighPublished 23 Oct 2026, 04:44 WIB

CVE-2026-96185

Microsoft Exchange Online Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:44:41.837Z. Updated 2026-10-29T15:08:16.645Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:08 WIB

Official record

CritPublished 23 Oct 2026, 04:44 WIB

CVE-2026-97785

AAD App Proxy Elevation of Privilege Vulnerability

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:44:41.227Z. Updated 2026-10-29T15:08:16.200Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:08 WIB

Official record

HighPublished 23 Oct 2026, 04:44 WIB

CVE-2026-108456

Azure AI Foundry Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:44:40.650Z. Updated 2026-10-29T15:08:15.677Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:08 WIB

Official record

CritPublished 23 Oct 2026, 04:44 WIB

CVE-2026-105014

Azure Pipelines Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:44:40.069Z. Updated 2026-10-29T15:08:14.156Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:08 WIB

Official record

CritPublished 23 Oct 2026, 04:39 WIB

CVE-2026-111594

InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:39:47.105Z. Updated 2026-10-22T21:39:47.105Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 04:39 WIB

Official record

MedPublished 23 Oct 2026, 04:34 WIB

CVE-2026-114620

Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself perfo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T21:34:11.909Z. Updated 2026-10-22T21:34:11.909Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 04:34 WIB

Official record