Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,616 published records · 20 KEV · 4,616 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,616 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3317.2%
High1,42031%
Med1,98843%
Low2104.5%
None360.78%
Legacy00.00%
Unscored63114%

Matching records by UTC month

Feb 264,616

Signal coverage

KEV-listed: 20
With a forecast: 4,616
Unknown date: 0
Unscored severity: 631

Share of cohort: KEV 0.43% · forecast 100% · unscored 14%.

Showing 441–460 of 4,616By severity band: Critical · 9.0–10.0 331, High · 7.0–8.9 1,420, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 210, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 631

MedPublished 26 Feb 2026, 01:57 WIB

CVE-2026-2636

Denial of Service in Microsoft OS

This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:57:02.962Z. Updated 2026-02-26T15:56:55.089Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:56 WIB

Official record

NonePublished 26 Feb 2026, 01:53 WIB

CVE-2026-24005

OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field

Kruise provides automated management of large-scale applications on Kubernetes. Prior to versions 1.8.3 and 1.7.5, PodProbeMarker allows defining custom probes with TCPSocket or HTTPGet handlers. The webhook validation does not restrict the Host field in these probe configurations. Since kruise-daemon runs with hostNet…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 441 to 460 of 4616.First page Next page

Published 2026-02-25T18:53:30.170Z. Updated 2026-02-26T20:44:09.282Z.

CVSS0v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:44 WIB

Official record

MedPublished 26 Feb 2026, 01:48 WIB

CVE-2026-25930

OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Layout-Based Form (LBF) printable view accepts `formid` and `visitid` (or `patientid`) from the request and does not verify that the form belongs to the current user’s authorized patient/…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:48:10.373Z. Updated 2026-02-26T20:43:11.655Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:43 WIB

Official record

MedPublished 26 Feb 2026, 01:46 WIB

CVE-2026-25929

OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s `patient_picture` context serves the patient’s photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An au…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:46:44.816Z. Updated 2026-02-26T21:33:41.863Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 04:33 WIB

Official record

HighPublished 26 Feb 2026, 01:43 WIB

CVE-2026-25927

OpenEMR Missing Authorization Checks in DICOM Viewer State API

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the DICOM viewer state API (e.g. upload or state save/load) accepts a document ID (`doc_id`) without verifying that the document belongs to the current user’s authorized patient or encounter…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:43:25.725Z. Updated 2026-02-26T21:33:41.716Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 04:33 WIB

Official record

HighPublished 26 Feb 2026, 01:39 WIB

CVE-2026-25746

OpenEMR has SQL Injection Vulnerability

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulnerability in prescription that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the prescription listi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:39:24.787Z. Updated 2026-02-26T20:54:39.616Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:54 WIB

Official record

HighPublished 26 Feb 2026, 01:33 WIB

CVE-2026-25743

OpenEMR has Stored XSS in Questionnaire answers

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, users with the "Forms administration" role can fill questionnaires ("forms") in patient encounters. The answers to the forms are displayed on the encounter page and in the visit history for t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:33:56.620Z. Updated 2026-02-26T20:53:59.221Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:53 WIB

Official record

UnscoredPublished 26 Feb 2026, 01:29 WIB

CVE-2026-3221

CVE-2026-3221

Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:29:11.939Z. Updated 2026-02-26T16:03:04.217Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:03 WIB

Official record

HighPublished 26 Feb 2026, 01:28 WIB

CVE-2026-25476

OpenEMR has Session Timeout Bypass via skip_timeout_reset

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the session expiration check in `library/auth.inc.php` runs only when `skip_timeout_reset` is not present in the request. When `skip_timeout_reset=1` is sent, the entire block that calls `Ses…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:28:29.881Z. Updated 2026-02-26T16:04:10.627Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:04 WIB

Official record

MedPublished 26 Feb 2026, 01:25 WIB

CVE-2026-25220

OpenEMR Messages "Show All" Not Restricted to Admins

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Message Center accepts the URL parameter `show_all=yes` and passes it to `getPnotesByUser()`, which returns all internal messages (all users’ notes). The backend does not verify that the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:25:06.228Z. Updated 2026-02-26T16:12:36.374Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:12 WIB

Official record

HighPublished 26 Feb 2026, 01:22 WIB

CVE-2026-25164

OpenEMR's Document and Insurance REST Endpoints Skip ACL

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in `apis/routes/_rest_routes_standard.inc.php` does not call `RestConfig::request_authorization_check()` for the document and insurance routes. Other patient routes i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:22:40.693Z. Updated 2026-02-26T16:13:42.534Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:13 WIB

Official record

CritPublished 26 Feb 2026, 01:14 WIB

CVE-2026-24908

OpenEMR has SQL Injection in Patient API Sort Parameter

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Patient REST API endpoint allows authenticated users with API access to execute arbitrary SQL queries through the `_sort` parameter. This could potential…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:14:03.504Z. Updated 2026-02-26T16:14:34.090Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:14 WIB

Official record

HighPublished 26 Feb 2026, 01:10 WIB

CVE-2026-24890

OpenEMR Portal Users Can Forge Provider Signatures

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the patient portal signature endpoint allows authenticated portal users to upload and overwrite provider signatures by setting `type=admin-signature` …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:10:22.910Z. Updated 2026-02-26T16:15:28.455Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:15 WIB

Official record

MedPublished 26 Feb 2026, 00:45 WIB

CVE-2026-24487

OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the FHIR CareTeam resource endpoint allows patient-scoped FHIR tokens to access care team data for all patients instead of being restricted to only th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T17:45:24.584Z. Updated 2026-02-26T20:48:47.360Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:48 WIB

Official record

HighPublished 26 Feb 2026, 00:39 WIB

CVE-2026-23627

OpenEMR has SQL Injection in Immunization Search/Report

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queries, leading to complete database compromise, PHI exfiltration, credential…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T17:39:20.540Z. Updated 2026-02-26T20:58:11.023Z.

CVSS7.4v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:58 WIB

Official record

MedPublished 26 Feb 2026, 00:30 WIB

CVE-2026-27795

LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T17:30:01.106Z. Updated 2026-02-25T18:42:52.277Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 01:42 WIB

Official record

LowPublished 26 Feb 2026, 00:02 WIB

CVE-2026-3194

Chia Blockchain RPC Server Master Passphrase get_private_key missing authentication

A flaw has been found in Chia Blockchain 2.1.0. The affected element is the function send_transaction/get_private_key of the component RPC Server Master Passphrase Handler. This manipulation causes missing authentication. The attack can only be executed locally. The attack's complexity is rated as high. The exploitabil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T17:02:17.420Z. Updated 2026-02-25T18:43:40.383Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 01:43 WIB

Official record

CritPublished 25 Feb 2026, 23:59 WIB

CVE-2026-21902

Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root

An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root. The On-Box Anomaly detection framework should only be reachable by other interna…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T16:59:10.672Z. Updated 2026-03-04T04:55:12.668Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated04 Mar 2026, 11:55 WIB

Official record

UnscoredPublished 25 Feb 2026, 23:58 WIB

CVE-2026-27850

Improper verification in Linksys MR9600, Linksys MX4200

Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T16:58:06.450Z. Updated 2026-02-25T19:11:29.416Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Feb 2026, 02:11 WIB

Official record

HighPublished 25 Feb 2026, 23:54 WIB

CVE-2026-25554

OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass

OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior si…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T16:54:11.845Z. Updated 2026-07-14T15:53:41.151Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record