Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 3341–3360 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 22 Oct 2026, 22:22 WIB

CVE-2026-94482

Next.js: Denial of Service in App Router using Server Actions

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages R…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T15:22:10.155Z. Updated 2026-10-22T15:22:10.155Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated22 Oct 2026, 22:22 WIB

Official record

HighPublished 22 Oct 2026, 22:22 WIB

CVE-2026-115453

Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries

Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3341 to 3360 of 16156.First page Next page

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T15:22:09.445Z. Updated 2026-10-26T11:11:04.861Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 18:11 WIB

Official record

HighPublished 22 Oct 2026, 22:13 WIB

CVE-2026-115450

Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier

External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T15:13:37.089Z. Updated 2026-10-26T11:09:07.323Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 18:09 WIB

Official record

HighPublished 22 Oct 2026, 22:07 WIB

CVE-2026-115482

CVE-2026-115482

In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T15:07:30.961Z. Updated 2026-10-22T19:00:31.416Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:00 WIB

Official record

MedPublished 22 Oct 2026, 21:58 WIB

CVE-2026-114515

OCO-Server: Self-Service Portal uninstall-job authorization bypass

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permiss…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T14:58:02.272Z. Updated 2026-10-23T15:03:45.075Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 22:03 WIB

Official record

HighPublished 22 Oct 2026, 21:55 WIB

CVE-2026-61791

OCO-Server: Stored XSS through agent hostnames in command buttons

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T14:55:54.269Z. Updated 2026-10-29T11:46:11.262Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:46 WIB

Official record

HighPublished 22 Oct 2026, 21:47 WIB

CVE-2026-16477

Insecure Deserialization of .cleanshot Files in CleanShot X

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, res…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T14:47:26.652Z. Updated 2026-10-22T19:00:31.571Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:00 WIB

Official record

HighPublished 22 Oct 2026, 21:46 WIB

CVE-2026-114510

Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T14:46:52.353Z. Updated 2026-10-22T14:46:52.353Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated22 Oct 2026, 21:46 WIB

Official record

HighPublished 22 Oct 2026, 21:29 WIB

CVE-2026-111181

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T14:29:56.577Z. Updated 2026-10-22T19:00:31.729Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:00 WIB

Official record

HighPublished 22 Oct 2026, 21:20 WIB

CVE-2026-113872

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pendi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T14:20:18.363Z. Updated 2026-10-22T19:00:31.884Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:00 WIB

Official record

MedPublished 22 Oct 2026, 20:50 WIB

CVE-2026-89410

Out-of-bounds read in Z-Wave NCP SPI Handler

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:50:41.357Z. Updated 2026-10-23T10:56:09.669Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

MedPublished 22 Oct 2026, 20:50 WIB

CVE-2026-89409

Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes

In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:50:04.309Z. Updated 2026-10-22T19:00:32.048Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:00 WIB

Official record

HighPublished 22 Oct 2026, 20:46 WIB

CVE-2026-85079

Out-of-bounds write in Zigbee Simple_Desc_req handling

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:46:39.556Z. Updated 2026-10-22T19:00:32.213Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 02:00 WIB

Official record

HighPublished 22 Oct 2026, 20:45 WIB

CVE-2026-94502

Out-of-bounds write in Zigbee Publish Price Matrix handling

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:45:30.856Z. Updated 2026-10-23T10:56:09.812Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

MedPublished 22 Oct 2026, 20:45 WIB

CVE-2026-115249

subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Impacted is an unknown function of the file patappointtime.php of the component Appointment Booking. This manipulation of the argument day/time/appdate causes improper input validation. The attack can b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:45:15.849Z. Updated 2026-10-29T11:41:57.646Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:41 WIB

Official record

MedPublished 22 Oct 2026, 20:44 WIB

CVE-2026-66282

Authenticated Denial-of-Service in Zigbee Publish Billing Period

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:44:08.429Z. Updated 2026-10-23T10:56:09.951Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

MedPublished 22 Oct 2026, 20:43 WIB

CVE-2026-66281

Authenticated Denial-of-Service in Zigbee Discover Attributes Handling

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:43:26.358Z. Updated 2026-10-23T10:56:10.091Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

MedPublished 22 Oct 2026, 20:42 WIB

CVE-2026-85080

Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the networ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:42:26.160Z. Updated 2026-10-23T10:56:10.233Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

HighPublished 22 Oct 2026, 20:41 WIB

CVE-2026-66279

Dis-connect vulnerability in Connect Stack

In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:41:03.391Z. Updated 2026-10-23T10:56:10.379Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 17:56 WIB

Official record

CritKEVPublished 22 Oct 2026, 20:35 WIB

CVE-2026-111497

Out-of-Bounds Write in Google Brotli Decoder

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2026-10-22T13:35:41.975Z. Updated 2026-10-28T03:55:48.896Z.

CVSS9.2v4.0KEVListedEPSSPresentUpdated28 Oct 2026, 10:55 WIB

Official record