Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3141–3160 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 22 Aug 2026, 21:12 WIB

CVE-2026-63312

NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive sy…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T14:12:40.731Z. Updated 2026-08-24T18:34:55.320Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 01:34 WIB

Official record

MedPublished 22 Aug 2026, 21:12 WIB

CVE-2026-63311

NLTK before 3.10.0 SSRF via DNS Resolution Failure

NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the valid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3141 to 3160 of 12259.First page Next page

Published 2026-08-22T14:12:40.063Z. Updated 2026-08-26T16:16:26.704Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 23:16 WIB

Official record

HighPublished 22 Aug 2026, 21:12 WIB

CVE-2026-62388

NLTK before 3.10.0 Insecure Default Configuration in pathsec.py

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T14:12:38.647Z. Updated 2026-08-29T11:47:32.048Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:47 WIB

Official record

HighPublished 22 Aug 2026, 21:12 WIB

CVE-2026-62385

NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T14:12:37.962Z. Updated 2026-08-24T19:07:55.247Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:07 WIB

Official record

HighPublished 22 Aug 2026, 21:12 WIB

CVE-2026-62384

NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T14:12:37.283Z. Updated 2026-08-24T18:39:40.142Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 01:39 WIB

Official record

MedPublished 22 Aug 2026, 21:12 WIB

CVE-2026-62383

nltk IPIPANCorpusReader Symlink Arbitrary File Read

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T14:12:36.606Z. Updated 2026-08-26T16:16:35.172Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 23:16 WIB

Official record

UnscoredPublished 22 Aug 2026, 20:52 WIB

CVE-2026-75866

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token dispatches on the grant_type in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T13:52:49.922Z. Updated 2026-08-25T19:29:36.357Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:29 WIB

Official record

UnscoredPublished 22 Aug 2026, 20:35 WIB

CVE-2026-75870

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T13:35:58.346Z. Updated 2026-08-25T19:28:36.443Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:28 WIB

Official record

LowPublished 22 Aug 2026, 20:34 WIB

CVE-2026-71514

NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated opener, so os.path.join di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T13:34:08.493Z. Updated 2026-08-24T19:18:14.123Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:18 WIB

Official record

HighPublished 22 Aug 2026, 20:34 WIB

CVE-2026-71513

NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T13:34:07.811Z. Updated 2026-08-27T16:24:50.539Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

MedPublished 22 Aug 2026, 20:27 WIB

CVE-2026-4559

Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T13:27:16.137Z. Updated 2026-08-24T19:19:46.524Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:19 WIB

Official record

MedPublished 22 Aug 2026, 20:27 WIB

CVE-2026-5093

Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb_update_global_wp_settings' function that only verifies the 'edit_posts' capability instead of requir…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T13:27:15.792Z. Updated 2026-08-24T13:01:22.177Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

MedPublished 22 Aug 2026, 20:27 WIB

CVE-2026-4561

MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This makes it possible for …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T13:27:15.451Z. Updated 2026-08-24T13:01:22.325Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

HighPublished 22 Aug 2026, 20:27 WIB

CVE-2026-2996

Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T13:27:14.956Z. Updated 2026-08-24T13:01:22.480Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

MedPublished 22 Aug 2026, 19:28 WIB

CVE-2026-4244

Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `duplicate_post()` function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has `edit_others_posts` capability before accepting a `se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T12:28:43.454Z. Updated 2026-08-24T13:01:22.632Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

MedPublished 22 Aug 2026, 19:26 WIB

CVE-2026-62382

PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates nil == nil as true, so the check passes and the deletable_by_v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T12:26:45.494Z. Updated 2026-08-31T16:54:50.167Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:54 WIB

Official record

MedPublished 22 Aug 2026, 19:26 WIB

CVE-2026-62381

luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow

luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload written after prependi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T12:26:44.558Z. Updated 2026-08-24T19:50:50.874Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:50 WIB

Official record

MedPublished 22 Aug 2026, 19:26 WIB

CVE-2026-62380

Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T12:26:43.777Z. Updated 2026-08-26T16:16:44.043Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 23:16 WIB

Official record

HighPublished 22 Aug 2026, 19:26 WIB

CVE-2026-62243

Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this config…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T12:26:43.072Z. Updated 2026-08-24T19:36:53.644Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:36 WIB

Official record

MedPublished 22 Aug 2026, 19:26 WIB

CVE-2026-62204

SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T12:26:41.933Z. Updated 2026-08-26T17:53:20.106Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:53 WIB

Official record