Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3241–3260 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 22 Aug 2026, 03:49 WIB

CVE-2026-69231

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. A…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:49:17.345Z. Updated 2026-08-24T13:01:24.680Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

MedPublished 22 Aug 2026, 03:49 WIB

CVE-2026-69230

stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3241 to 3260 of 12259.First page Next page

Published 2026-08-21T20:49:01.503Z. Updated 2026-08-24T13:01:24.833Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

MedPublished 22 Aug 2026, 03:48 WIB

CVE-2026-69229

HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All users are advised to u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:48:46.187Z. Updated 2026-08-24T13:01:24.985Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

MedPublished 22 Aug 2026, 03:48 WIB

CVE-2026-69228

missing authentication vulnerability in Esri Portal for ArcGIS

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:48:27.128Z. Updated 2026-08-24T13:01:25.136Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

CritPublished 22 Aug 2026, 03:47 WIB

CVE-2026-77413

JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and ge…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:47:08.457Z. Updated 2026-08-24T19:42:37.844Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:42 WIB

Official record

MedPublished 22 Aug 2026, 03:46 WIB

CVE-2026-69225

information disclosure vulnerability in Esri Portal for ArcGIS

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:46:39.386Z. Updated 2026-08-24T13:01:25.294Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

LowPublished 22 Aug 2026, 03:46 WIB

CVE-2026-69238

HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to up…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:46:03.539Z. Updated 2026-08-24T13:01:25.446Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

MedPublished 22 Aug 2026, 03:45 WIB

CVE-2026-69224

information disclosure vulnerability in Esri Portal for ArcGIS

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:45:03.056Z. Updated 2026-08-24T13:01:25.595Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated24 Aug 2026, 20:01 WIB

Official record

HighPublished 22 Aug 2026, 03:44 WIB

CVE-2026-77354

kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, af…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:44:47.792Z. Updated 2026-08-25T19:15:23.235Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:15 WIB

Official record

HighPublished 22 Aug 2026, 03:43 WIB

CVE-2026-76905

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:43:07.066Z. Updated 2026-08-25T14:21:42.702Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:21 WIB

Official record

HighPublished 22 Aug 2026, 03:40 WIB

CVE-2026-63135

YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain()…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:40:08.199Z. Updated 2026-08-26T17:40:42.981Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:40 WIB

Official record

HighPublished 22 Aug 2026, 03:40 WIB

CVE-2026-30890

Combodo iTop: Reflected XSS in synchro/synchro_import.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

Excerpt language: en.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:40:05.045Z. Updated 2026-08-26T17:39:53.193Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:39 WIB

Official record

HighPublished 22 Aug 2026, 03:37 WIB

CVE-2026-30865

Combodo iTop: Reflected XSS in dashboard save

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:37:20.408Z. Updated 2026-08-24T19:43:49.989Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:43 WIB

Official record

CritPublished 22 Aug 2026, 03:37 WIB

CVE-2026-61539

Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Requests to /v1/chat/completions with a tools…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:37:02.633Z. Updated 2026-08-24T19:45:13.875Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:45 WIB

Official record

MedPublished 22 Aug 2026, 03:34 WIB

CVE-2026-53656

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: *. Because the embedded server is local and unau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:34:55.783Z. Updated 2026-08-21T21:42:44.374Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:42 WIB

Official record

HighPublished 22 Aug 2026, 03:34 WIB

CVE-2026-54457

TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] config…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:34:03.632Z. Updated 2026-08-25T13:38:42.654Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 20:38 WIB

Official record

MedPublished 22 Aug 2026, 03:31 WIB

CVE-2026-55168

Runtipi: Authenticated arbitrary file write via backup restore symlink planting

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:31:38.124Z. Updated 2026-08-25T17:01:52.501Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:01 WIB

Official record

HighPublished 22 Aug 2026, 03:29 WIB

CVE-2026-64679

Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before join…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:29:55.106Z. Updated 2026-08-25T17:05:09.821Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:05 WIB

Official record

MedPublished 22 Aug 2026, 03:29 WIB

CVE-2026-44517

Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:29:00.354Z. Updated 2026-08-25T17:07:10.143Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:07 WIB

Official record

CritPublished 22 Aug 2026, 03:25 WIB

CVE-2026-59989

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt templat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T20:25:44.767Z. Updated 2026-08-27T16:24:50.700Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record