Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 3221–3240 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 17 Mar 2026, 02:19 WIB

CVE-2026-30881

Chamilo LMS: SQL Injection in the statistics AJAX endpoint

Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters date_start and date_end from $_REQUEST are embedded directly into a raw SQL string without proper sanitization. Although Database::escape_string() is called downs…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T19:19:59.782Z. Updated 2026-03-16T20:22:42.641Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Mar 2026, 03:22 WIB

Official record

MedPublished 17 Mar 2026, 02:18 WIB

CVE-2026-30876

Chamilo LMS: User enumeration vulnerability via response

Chamilo LMS is a learning management system. Prior to version 1.11.36, Chamilo is vulnerable to user enumeration with valid/invalid username. This issue has been patched in version 1.11.36.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3221 to 3240 of 6236.First page Next page

Published 2026-03-16T19:18:41.508Z. Updated 2026-03-16T20:22:42.799Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 03:22 WIB

Official record

HighPublished 17 Mar 2026, 02:16 WIB

CVE-2026-30875

Chamilo LMS: Authenticated RCE via H5P Import

Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T19:16:37.936Z. Updated 2026-03-16T20:22:42.979Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Mar 2026, 03:22 WIB

Official record

CritPublished 17 Mar 2026, 02:13 WIB

CVE-2026-28430

Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php

Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a predictable legacy password reset mechanism, an attacker can achieve full…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T19:13:58.544Z. Updated 2026-03-17T13:38:36.572Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 20:38 WIB

Official record

MedPublished 17 Mar 2026, 02:07 WIB

CVE-2026-29516

Buffalo TeraStation TS5400R Excessive File Permissions Information Disclosure

Buffalo TeraStation NAS TS5400R firmware version 4.02-0.06 and prior contain an excessive file permissions vulnerability that allows authenticated attackers to read the /etc/shadow file by uploading and executing a PHP file through the webserver. Attackers can exploit world-readable permissions on /etc/shadow to retrie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T19:07:52.684Z. Updated 2026-05-11T23:11:43.348Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 May 2026, 06:11 WIB

Official record

HighPublished 17 Mar 2026, 02:04 WIB

CVE-2026-32267

Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithTo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T19:04:47.781Z. Updated 2026-03-18T15:43:25.399Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated18 Mar 2026, 22:43 WIB

Official record

HighPublished 17 Mar 2026, 02:02 WIB

CVE-2026-32264

Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T19:02:22.720Z. Updated 2026-03-17T15:20:28.421Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 22:20 WIB

Official record

HighPublished 17 Mar 2026, 01:57 WIB

CVE-2026-32263

Craft CMS vulnerable to behavior injection RCE via EntryTypesController

Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via "as" or "on" pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T18:57:50.342Z. Updated 2026-03-17T15:21:16.718Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 22:21 WIB

Official record

MedPublished 17 Mar 2026, 01:57 WIB

CVE-2026-32262

Craft CMS has a Path Traversal Vulnerability in AssetsController

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T18:57:46.516Z. Updated 2026-03-17T15:22:08.875Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 22:22 WIB

Official record

HighPublished 17 Mar 2026, 01:50 WIB

CVE-2026-32261

RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin

Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events occur. From version 3.0.0 to before version 3.2.0, the Webhooks plugin renders user-supplied template content through Twig’s renderString() function without sandbox protection. This…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T18:50:18.158Z. Updated 2026-03-16T19:27:05.370Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 02:27 WIB

Official record

HighPublished 17 Mar 2026, 01:07 WIB

CVE-2025-69196

FastMCP OAuth Proxy token reuse across MCP servers

FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T18:07:06.332Z. Updated 2026-07-15T01:24:57.569Z.

CVSS7.4v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

MedPublished 17 Mar 2026, 01:03 WIB

CVE-2026-4269

Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. This issue only affects users of the Bedrock AgentCore Starter Toolkit before version v0.1.13 who buil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T18:03:56.124Z. Updated 2026-03-16T18:12:08.533Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 01:12 WIB

Official record

HighPublished 17 Mar 2026, 01:03 WIB

CVE-2026-28498

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for va…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T18:03:28.821Z. Updated 2026-09-10T12:04:48.234Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated10 Sep 2026, 19:04 WIB

Official record

MedPublished 17 Mar 2026, 00:52 WIB

CVE-2026-4224

Stack overflow parsing XML with deeply nested DTD content models

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T17:52:26.639Z. Updated 2026-08-13T00:27:37.326Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated13 Aug 2026, 07:27 WIB

Official record

HighPublished 17 Mar 2026, 00:37 WIB

CVE-2026-28490

Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its def…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T17:37:57.425Z. Updated 2026-03-16T18:17:35.003Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 01:17 WIB

Official record

MedPublished 17 Mar 2026, 00:37 WIB

CVE-2026-3644

Incomplete control character validation in http.cookies

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.ou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T17:37:31.344Z. Updated 2026-08-13T00:27:41.980Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated13 Aug 2026, 07:27 WIB

Official record

CritPublished 17 Mar 2026, 00:34 WIB

CVE-2026-27962

Authlib JWS JWK Header Injection: Signature Verification Bypass

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization fu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T17:34:38.946Z. Updated 2026-09-10T12:04:56.626Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated10 Sep 2026, 19:04 WIB

Official record

CritPublished 17 Mar 2026, 00:32 WIB

CVE-2026-4254

Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow

A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToolChangePwd of the component HTTP Endpoint. This manipulation of the argument local_2c causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has bee…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T17:32:11.090Z. Updated 2026-03-16T18:29:35.800Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 01:29 WIB

Official record

HighPublished 17 Mar 2026, 00:28 WIB

CVE-2026-23862

CVE-2026-23862

Dell ThinOS 10 versions prior to ThinOS 2602_10.0573, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T17:28:44.696Z. Updated 2026-03-17T03:55:37.692Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Mar 2026, 10:55 WIB

Official record

CritPublished 17 Mar 2026, 00:12 WIB

CVE-2026-23489

Fields GLPI plugin vulnerable to RCE in dropdown generation

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T17:12:43.964Z. Updated 2026-03-16T17:51:31.011Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated17 Mar 2026, 00:51 WIB

Official record