Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 3201–3220 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115374

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, discl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:43.999Z. Updated 2026-10-23T15:01:34.195Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 22:01 WIB

Official record

HighPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115373

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environmen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3201 to 3220 of 16156.First page Next page

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:43.300Z. Updated 2026-10-29T11:57:51.417Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:57 WIB

Official record

CritPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115372

Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options

Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:42.624Z. Updated 2026-10-29T02:28:30.115Z.

CVSS9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:28 WIB

Official record

HighPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115371

LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete obje…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:41.898Z. Updated 2026-10-22T19:13:41.898Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:13 WIB

Official record

MedPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115370

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:41.181Z. Updated 2026-10-23T15:01:52.150Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 22:01 WIB

Official record

LowPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115369

OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs

OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated callers with sign permission can submit a CSR with an out-of-range IP SAN to pki/sign/<role> and obtain CA-signed certificates for unauthorized IPs.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:40.448Z. Updated 2026-10-29T11:56:36.361Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:56 WIB

Official record

LowPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115366

OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/* is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones, or register installed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:39.752Z. Updated 2026-10-26T19:38:30.184Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 02:38 WIB

Official record

HighPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115365

OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the roo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:39.017Z. Updated 2026-10-22T19:13:39.017Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:13 WIB

Official record

LowPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115364

OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:38.282Z. Updated 2026-10-23T15:02:16.016Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 22:02 WIB

Official record

LowPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115363

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener cer…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:37.600Z. Updated 2026-10-29T11:56:00.897Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:56 WIB

Official record

LowPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115362

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:36.857Z. Updated 2026-10-29T02:27:07.016Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:27 WIB

Official record

LowPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115361

OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial

OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:36.151Z. Updated 2026-10-22T19:13:36.151Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:13 WIB

Official record

MedPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115360

OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:35.435Z. Updated 2026-10-23T21:07:08.070Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 04:07 WIB

Official record

MedPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115359

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing

OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:34.716Z. Updated 2026-10-29T11:54:37.275Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:54 WIB

Official record

LowPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115358

OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:34.006Z. Updated 2026-10-29T02:26:32.401Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:26 WIB

Official record

LowPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115357

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:33.290Z. Updated 2026-10-22T19:13:33.290Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:13 WIB

Official record

MedPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115356

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:32.611Z. Updated 2026-10-23T15:02:35.215Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 22:02 WIB

Official record

HighPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115355

Mistune before 3.3.0 Path Traversal and XSS via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=Tru…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:31.904Z. Updated 2026-10-29T13:48:43.278Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:48 WIB

Official record

HighPublished 23 Oct 2026, 02:13 WIB

CVE-2026-114519

Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts

Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and D…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:31.254Z. Updated 2026-10-22T19:13:31.254Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:13 WIB

Official record

HighPublished 23 Oct 2026, 02:13 WIB

CVE-2026-115354

Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T19:13:31.132Z. Updated 2026-10-29T02:25:47.787Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:25 WIB

Official record