Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3201–3220 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 22 Aug 2026, 05:51 WIB

CVE-2026-53541

OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any arg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T22:51:52.752Z. Updated 2026-08-24T20:03:47.277Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 03:03 WIB

Official record

HighPublished 22 Aug 2026, 05:49 WIB

CVE-2026-48106

Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. The `MsgReplicateSync` payload itself is accepted without any…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3201 to 3220 of 12259.First page Next page

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T22:49:12.016Z. Updated 2026-08-26T17:47:20.195Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:47 WIB

Official record

HighPublished 22 Aug 2026, 05:47 WIB

CVE-2026-48105

Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`) accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. The only check is th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T22:47:13.993Z. Updated 2026-08-24T18:45:11.830Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 01:45 WIB

Official record

HighPublished 22 Aug 2026, 05:42 WIB

CVE-2026-47735

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked only `read_parquet(` and `arc_partition_agg(` via regex denylist. The broader DuckDB I/O function family — `read_csv_auto`, `read_csv`, `read_json`, `rea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T22:42:55.886Z. Updated 2026-08-25T13:35:54.838Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 20:35 WIB

Official record

HighPublished 22 Aug 2026, 05:40 WIB

CVE-2026-48050

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T22:40:12.771Z. Updated 2026-08-25T16:44:36.584Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:44 WIB

Official record

MedPublished 22 Aug 2026, 05:31 WIB

CVE-2026-34949

Combodo iTop: Unauthenticated user can delete .readonly file

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T22:31:49.110Z. Updated 2026-08-26T17:46:25.524Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:46 WIB

Official record

HighPublished 22 Aug 2026, 05:29 WIB

CVE-2026-53499

FORT-validator Vulnerable to RRDP Shared Snapshot Cache Poisoning

FORT Validator is a Resource Public Key Infrastructure (RPKI) relying-party validator that produces validated route-origin data. FORT Validator versions through 1.6.7 contain an origin-validation error in their RRDP processing: a delegated CA under the same Trust Anchor Locator (TAL) can reference a victim CA’s public …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T22:29:48.970Z. Updated 2026-08-25T19:24:28.228Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:24 WIB

Official record

HighPublished 22 Aug 2026, 05:26 WIB

CVE-2026-34948

Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T22:26:22.269Z. Updated 2026-08-24T18:45:55.043Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 01:45 WIB

Official record

HighPublished 22 Aug 2026, 05:19 WIB

CVE-2026-53525

WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T22:19:21.278Z. Updated 2026-08-25T16:46:03.941Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:46 WIB

Official record

MedPublished 22 Aug 2026, 05:18 WIB

CVE-2026-53524

WeeChat has a Decompression Bomb in Relay WebSocket (DoS)

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relay_websocket_inflate() has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 by…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T22:18:23.432Z. Updated 2026-08-24T20:09:16.871Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 03:09 WIB

Official record

MedPublished 22 Aug 2026, 04:54 WIB

CVE-2026-34836

Combodo iTop: Improper access control in ajax.render.php and ajax.document.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T21:54:45.168Z. Updated 2026-08-25T19:24:38.076Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:24 WIB

Official record

HighPublished 22 Aug 2026, 04:50 WIB

CVE-2026-34741

Combodo iTop: Authentication bypass in exec.php allows PHP file execution

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T21:50:49.229Z. Updated 2026-08-26T17:45:52.461Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:45 WIB

Official record

LowPublished 22 Aug 2026, 04:46 WIB

CVE-2026-33333

Combodo iTop: Information disclosure in ajax.render.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T21:46:00.590Z. Updated 2026-08-24T18:47:12.059Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 01:47 WIB

Official record

MedPublished 22 Aug 2026, 04:35 WIB

CVE-2026-53487

Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T21:35:41.451Z. Updated 2026-08-25T16:47:05.989Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:47 WIB

Official record

MedPublished 22 Aug 2026, 04:34 WIB

CVE-2026-53531

ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-threa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T21:34:16.017Z. Updated 2026-08-25T16:51:41.853Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 23:51 WIB

Official record

HighPublished 22 Aug 2026, 04:31 WIB

CVE-2026-53530

ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T21:31:12.665Z. Updated 2026-08-24T20:05:00.628Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 03:05 WIB

Official record

MedPublished 22 Aug 2026, 04:29 WIB

CVE-2026-53529

LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T21:29:11.952Z. Updated 2026-08-21T21:42:08.184Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:42 WIB

Official record

HighPublished 22 Aug 2026, 04:26 WIB

CVE-2026-53528

FileWiki has path traversal in RenameAsset via unsanitized oldFilename parameter

LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could allow sensitive local fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T21:26:57.603Z. Updated 2026-08-26T17:44:35.905Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:44 WIB

Official record

HighPublished 22 Aug 2026, 04:25 WIB

CVE-2026-53527

LeafWiki Vulnerable to Privilege Escalation via User Self-Service Update

LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their own account role and escalate privileges from a regular user, such as `viewer`, to `admin`. Exploitation requires a valid authenticated LeafWiki user a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T21:25:16.330Z. Updated 2026-08-24T18:48:07.698Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 01:48 WIB

Official record

HighPublished 22 Aug 2026, 04:25 WIB

CVE-2026-33240

Combodo iTop: Reflected XSS in foreign key search criteria

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T21:25:03.819Z. Updated 2026-08-25T13:30:28.076Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 20:30 WIB

Official record