Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3321–3340 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 21 Aug 2026, 23:31 WIB

CVE-2026-74583

net/sched: cls_route: fix fastmap use-after-free on filter

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via route4_set_fa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T16:31:55.886Z. Updated 2026-10-16T19:05:58.388Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 21 Aug 2026, 23:31 WIB

CVE-2026-74582

packet: use consistent hard_header_len in non-ring send paths

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding devi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3321 to 3340 of 12259.First page Next page

Published 2026-08-21T16:31:55.283Z. Updated 2026-10-16T19:05:58.230Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

CritPublished 21 Aug 2026, 23:31 WIB

CVE-2026-74581

net: ipv6: clear suppressed fib6 rule result

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T16:31:54.683Z. Updated 2026-10-16T19:05:58.061Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 21 Aug 2026, 23:31 WIB

CVE-2026-74580

vhost: reset the vring metadata cache on vring reconfiguration

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the hit as proof that the region has already …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T16:31:54.076Z. Updated 2026-10-29T03:57:01.255Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 10:57 WIB

Official record

HighPublished 21 Aug 2026, 23:13 WIB

CVE-2026-54789

mod_auth_openidc has out-of-bounds read and write in state cookie parsing

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T16:13:23.073Z. Updated 2026-09-02T19:06:57.449Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated03 Sep 2026, 02:06 WIB

Official record

HighPublished 21 Aug 2026, 23:13 WIB

CVE-2026-22681

OpenViking < 0.3.4 SSRF via /api/v1/resources

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server to issue outbound HEAD …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T16:13:07.416Z. Updated 2026-10-01T15:19:49.057Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

HighPublished 21 Aug 2026, 23:11 WIB

CVE-2026-75933

Jet Admin Stored XSS

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T16:11:47.849Z. Updated 2026-08-21T16:46:26.315Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:46 WIB

Official record

CritPublished 21 Aug 2026, 23:11 WIB

CVE-2026-75932

Jet Admin tenant isolation failure

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T16:11:24.871Z. Updated 2026-08-21T16:45:46.719Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:45 WIB

Official record

MedPublished 21 Aug 2026, 23:10 WIB

CVE-2026-75928

Brushfire unauthenticated information disclosure

The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T16:10:59.762Z. Updated 2026-08-21T16:44:39.357Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:44 WIB

Official record

MedPublished 21 Aug 2026, 23:10 WIB

CVE-2026-49114

ONNX symlink-following and path-traversal arbitrary file write

In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes exter…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T16:10:56.241Z. Updated 2026-08-21T16:43:10.933Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:43 WIB

Official record

CritPublished 21 Aug 2026, 23:03 WIB

CVE-2026-69502

Azure SQL Database Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T16:03:56.685Z. Updated 2026-10-28T20:08:58.857Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:08 WIB

Official record

HighPublished 21 Aug 2026, 22:03 WIB

CVE-2026-77815

Infinite Image Browsing Resolves Paths With normpath, Allowing Symlink Escape From Scanned Directories

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is_path_trusted in scripts/iib/api.py while pointing outside t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T15:03:09.325Z. Updated 2026-09-24T14:19:40.444Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

HighPublished 21 Aug 2026, 22:03 WIB

CVE-2026-77814

Infinite Image Browsing is_path_trusted Prefix Comparison Omits the Trailing Path Separator

is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /dat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T15:03:08.589Z. Updated 2026-09-24T14:19:39.501Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

CritPublished 21 Aug 2026, 22:03 WIB

CVE-2026-77087

Paperclip before 0.3.1 Remote Code Execution via DNS Rebinding

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T15:03:07.894Z. Updated 2026-10-01T19:19:28.826Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

MedPublished 21 Aug 2026, 21:57 WIB

CVE-2026-50278

iccDEV: CIccEmbedIO::Read8() size_t underflow

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a `CIccEmbedIO::Read8()` size_t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing `icSigEmbeddedV5ProfileTag` data with `icSigEmbeddedProfileT…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T14:57:10.283Z. Updated 2026-08-26T17:29:06.120Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:29 WIB

Official record

CritPublished 21 Aug 2026, 21:53 WIB

CVE-2026-63343

Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T14:53:26.109Z. Updated 2026-08-21T21:44:03.623Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:44 WIB

Official record

CritPublished 21 Aug 2026, 21:49 WIB

CVE-2026-63125

Incus vulnerable to root RCE via image backup.yaml symlink

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host fil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T14:49:16.844Z. Updated 2026-08-21T15:02:55.718Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 22:02 WIB

Official record

CritPublished 21 Aug 2026, 21:47 WIB

CVE-2026-62941

Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T14:47:56.724Z. Updated 2026-08-21T16:44:16.507Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:44 WIB

Official record

CritPublished 21 Aug 2026, 21:47 WIB

CVE-2026-62940

Incus has a project restriction bypass via instance migration config override

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `security.privileged` and `raw.lxc`) are applied without any project restriction enforcement, allowing a res…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T14:47:13.386Z. Updated 2026-08-21T15:13:46.664Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 22:13 WIB

Official record

CritPublished 21 Aug 2026, 21:45 WIB

CVE-2026-62867

Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-21T14:45:35.859Z. Updated 2026-08-21T21:44:10.367Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:44 WIB

Official record