Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 3301–3320 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 23 Oct 2026, 01:22 WIB

CVE-2026-114613

MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T18:22:40.544Z. Updated 2026-10-23T21:08:06.271Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 04:08 WIB

Official record

LowPublished 23 Oct 2026, 01:18 WIB

CVE-2026-115519

Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3301 to 3320 of 16156.First page Next page

Published 2026-10-22T18:18:33.751Z. Updated 2026-10-22T18:18:33.751Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 01:18 WIB

Official record

MedPublished 23 Oct 2026, 01:05 WIB

CVE-2026-115517

Unrestricted network access between execution contexts in KNIME Business Hub

Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open network ports on executors in different execution contexts. This only poses a security issue if the IP address of the attacked executor is know and there are open network…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T18:05:11.649Z. Updated 2026-10-22T18:05:11.649Z.

CVSS6.4v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 01:05 WIB

Official record

CritPublished 23 Oct 2026, 01:01 WIB

CVE-2026-114612

LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T18:01:52.768Z. Updated 2026-10-22T18:01:52.768Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 01:01 WIB

Official record

MedPublished 23 Oct 2026, 01:00 WIB

CVE-2026-113876

SmileCDR HAPI FHIR unauthorized read

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T18:00:15.049Z. Updated 2026-10-26T12:57:43.477Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 19:57 WIB

Official record

LowPublished 23 Oct 2026, 01:00 WIB

CVE-2026-113875

SmileCDR HAPI FHIR unauthorized read via subscription

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T18:00:01.244Z. Updated 2026-10-26T12:57:40.749Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 19:57 WIB

Official record

HighPublished 23 Oct 2026, 00:58 WIB

CVE-2026-113874

SmileCDR HAPI FHIR trusted tenant partition override

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:58:56.709Z. Updated 2026-10-26T12:57:44.881Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 19:57 WIB

Official record

HighPublished 23 Oct 2026, 00:57 WIB

CVE-2026-113873

SmileCDR HAPI FHIR improper data decompression

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:57:52.475Z. Updated 2026-10-26T12:57:42.150Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 19:57 WIB

Official record

HighPublished 23 Oct 2026, 00:57 WIB

CVE-2026-97635

Agent Zero Web UI XSS

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:57:24.056Z. Updated 2026-10-22T17:57:24.056Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 00:57 WIB

Official record

MedPublished 23 Oct 2026, 00:50 WIB

CVE-2026-77157

ast-cli: Auto-update downloads are not verified against a checksum before execution

ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not verified against a ch…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:50:51.933Z. Updated 2026-10-22T17:50:51.933Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 00:50 WIB

Official record

MedPublished 23 Oct 2026, 00:44 WIB

CVE-2026-77156

ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:44:34.313Z. Updated 2026-10-22T17:49:25.326Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 00:49 WIB

Official record

HighPublished 23 Oct 2026, 00:38 WIB

CVE-2026-108357

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern che…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:38:16.098Z. Updated 2026-10-23T21:08:17.784Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 04:08 WIB

Official record

MedPublished 23 Oct 2026, 00:36 WIB

CVE-2026-13599

ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB

Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:36:17.225Z. Updated 2026-10-22T19:00:30.651Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:00 WIB

Official record

CritPublished 23 Oct 2026, 00:33 WIB

CVE-2026-114611

OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERI…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:33:13.611Z. Updated 2026-10-29T02:23:10.004Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:23 WIB

Official record

HighPublished 23 Oct 2026, 00:32 WIB

CVE-2026-108359

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materia…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:32:49.724Z. Updated 2026-10-29T11:51:32.420Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:51 WIB

Official record

HighPublished 23 Oct 2026, 00:32 WIB

CVE-2026-93336

Missing authorization in the unit resources download route in Juju controllers

Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:32:13.820Z. Updated 2026-10-22T17:32:13.820Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 00:32 WIB

Official record

HighPublished 23 Oct 2026, 00:29 WIB

CVE-2026-108358

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:29:56.449Z. Updated 2026-10-23T21:08:28.517Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 04:08 WIB

Official record

MedPublished 23 Oct 2026, 00:26 WIB

CVE-2026-108360

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redir…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:26:59.148Z. Updated 2026-10-29T11:50:16.342Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:50 WIB

Official record

LowPublished 23 Oct 2026, 00:22 WIB

CVE-2026-54238

Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed with the same tenant secre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:22:50.862Z. Updated 2026-10-22T17:22:50.862Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 00:22 WIB

Official record

MedPublished 23 Oct 2026, 00:21 WIB

CVE-2026-114610

fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T17:21:11.788Z. Updated 2026-10-29T02:22:14.998Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:22 WIB

Official record