Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 3341–3360 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 16 Mar 2026, 13:32 WIB

CVE-2026-4222

SSCMS download PathUtils.RemoveParentPath path traversal

A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/actions/download. This manipulation of the argument path causes path traversal. Remote exploitation of the attack is possible. The exploit has been publicly disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T06:32:22.384Z. Updated 2026-03-16T15:17:18.071Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 22:17 WIB

Official record

MedPublished 16 Mar 2026, 13:32 WIB

CVE-2026-4221

Tiandy Easy7 Integrated Management Platform Endpoint uploadLedImage unrestricted upload

A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This affects an unknown part of the file /rest/file/uploadLedImage of the component Endpoint. The manipulation of the argument File results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3341 to 3360 of 6236.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T06:32:17.960Z. Updated 2026-03-16T15:20:47.049Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 22:20 WIB

Official record

HighPublished 16 Mar 2026, 13:31 WIB

CVE-2026-32775

CVE-2026-32775

libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T06:31:36.015Z. Updated 2026-04-12T18:23:28.578Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated13 Apr 2026, 01:23 WIB

Official record

LowPublished 16 Mar 2026, 13:13 WIB

CVE-2025-71264

CVE-2025-71264

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T06:13:51.207Z. Updated 2026-03-16T14:40:37.627Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated16 Mar 2026, 21:40 WIB

Official record

MedPublished 16 Mar 2026, 13:02 WIB

CVE-2026-4220

Technologies Integrated Management Platform SetWebpagePic.jsp unrestricted upload

A vulnerability has been found in Technologies Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /SetWebpagePic.jsp. The manipulation of the argument targetPath/Suffix leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T06:02:23.103Z. Updated 2026-03-16T15:21:24.965Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 22:21 WIB

Official record

MedPublished 16 Mar 2026, 13:02 WIB

CVE-2026-4219

INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App ae.index.apgcs BuildConfig.java hard-coded credentials

A flaw has been found in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App up to 1.0.2 on Android. Affected by this vulnerability is an unknown functionality of the file com/index/event/BuildConfig.java of the component ae.index.apgcs. Executing a manipulation of the argument ACCESS_KEY/HASH_KEY can lead …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T06:02:08.055Z. Updated 2026-03-16T15:27:30.797Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 22:27 WIB

Official record

LowPublished 16 Mar 2026, 12:32 WIB

CVE-2026-4218

myAEDES App aedes.me.beta EngageBayUtils.java information disclosure

A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the component aedes.me.beta. Performing a manipulation of the argument AUTH_KEY results in information disclosure. The attack is only possible with local access. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T05:32:07.692Z. Updated 2026-03-16T15:28:24.287Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 22:28 WIB

Official record

HighPublished 16 Mar 2026, 12:21 WIB

CVE-2026-31386

CVE-2026-31386

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T05:21:13.948Z. Updated 2026-03-16T15:29:03.838Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 22:29 WIB

Official record

LowPublished 16 Mar 2026, 12:02 WIB

CVE-2026-4217

XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage

A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in ai/nreal/nebula/flutterPlugin/CloudStoragePlugin.java of the component ai.nreal.nebula.universal. Such manipulation of the argument accessKey/secretAccessKey/securityToken leads to unpr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T05:02:10.796Z. Updated 2026-03-16T15:29:54.628Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 22:29 WIB

Official record

MedPublished 16 Mar 2026, 12:02 WIB

CVE-2026-4216

i-SENS SmartLog App air.SmartLog.android hard-coded credentials

A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android. This affects an unknown function of the component air.SmartLog.android. This manipulation causes hard-coded credentials. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T05:02:08.472Z. Updated 2026-03-16T18:45:09.497Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 01:45 WIB

Official record

HighPublished 16 Mar 2026, 11:35 WIB

CVE-2026-21005

CVE-2026-21005

Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T04:35:37.481Z. Updated 2026-03-16T13:19:35.051Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 20:19 WIB

Official record

MedPublished 16 Mar 2026, 11:35 WIB

CVE-2026-21004

CVE-2026-21004

Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T04:35:36.283Z. Updated 2026-03-16T13:19:35.280Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 20:19 WIB

Official record

MedPublished 16 Mar 2026, 11:32 WIB

CVE-2026-4215

FlowCI flow-core-x SMTP Host ConfigServiceImpl.java save server-side request forgery

A security flaw has been discovered in FlowCI flow-core-x up to 1.23.01. The impacted element is the function Save of the file core/src/main/java/com/flowci/core/config/service/ConfigServiceImpl.java of the component SMTP Host Handler. The manipulation results in server-side request forgery. The attack may be performed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T04:32:12.679Z. Updated 2026-03-16T18:46:08.066Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 01:46 WIB

Official record

MedPublished 16 Mar 2026, 11:32 WIB

CVE-2026-21002

CVE-2026-21002

Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary application.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T04:32:11.128Z. Updated 2026-03-16T13:59:29.066Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 20:59 WIB

Official record

HighPublished 16 Mar 2026, 11:32 WIB

CVE-2026-4214

D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Setting stack-based overflow

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This issue affects the function UPnP_AV_Server_Path_Setting of the fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T04:32:10.373Z. Updated 2026-03-16T14:40:37.489Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 21:40 WIB

Official record

MedPublished 16 Mar 2026, 11:32 WIB

CVE-2026-21001

CVE-2026-21001

Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T04:32:09.910Z. Updated 2026-03-16T13:59:43.525Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 20:59 WIB

Official record

HighPublished 16 Mar 2026, 11:32 WIB

CVE-2026-21000

CVE-2026-21000

Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T04:32:08.760Z. Updated 2026-03-16T13:19:35.418Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 20:19 WIB

Official record

HighPublished 16 Mar 2026, 11:32 WIB

CVE-2026-20999

CVE-2026-20999

Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T04:32:07.607Z. Updated 2026-03-16T13:19:35.560Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 20:19 WIB

Official record

HighPublished 16 Mar 2026, 11:32 WIB

CVE-2026-20998

CVE-2026-20998

Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T04:32:06.400Z. Updated 2026-03-16T13:19:35.805Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 20:19 WIB

Official record

MedPublished 16 Mar 2026, 11:32 WIB

CVE-2026-20997

CVE-2026-20997

Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-16T04:32:05.126Z. Updated 2026-03-16T13:19:35.995Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 20:19 WIB

Official record