Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 441–460 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 30 Aug 2026, 12:30 WIB

CVE-2026-82480

NASA cFS cFE Software Bus cfe_sb_util.c CFE_SB_GetUserDataLength integer underflow

A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLength of the file src/cFS/cfe/modules/sb/fsw/src/cfe_sb_util.c of the component cFE Software Bus. Performing a manipulation of the argument TotalMsgSize/HdrSize results in integer underflow. It is possib…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T05:30:09.275Z. Updated 2026-08-31T17:06:07.604Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:06 WIB

Official record

MedPublished 30 Aug 2026, 12:00 WIB

CVE-2026-82479

NASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow

A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file modules/protocol/tcp/fsw/src/sbn_tcp_if.c of the component SBN TCP Module. Such manipulation of the argument MsgSz leads to buffer overflow. The attack must be carried out from within the local network. The vendor was c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 441 to 460 of 12259.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T05:00:09.833Z. Updated 2026-08-31T18:42:58.217Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:42 WIB

Official record

CritPublished 30 Aug 2026, 11:25 WIB

CVE-2026-15980

MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an acti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T04:25:48.138Z. Updated 2026-08-31T19:52:37.077Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 02:52 WIB

Official record

MedPublished 30 Aug 2026, 11:15 WIB

CVE-2026-82478

NASA Trick TCP Socket JSONVariableServerThread.cpp parse_request stack-based overflow

A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp of the component TCP Socket Handler. This manipulation causes stack-based buffer overflow. The attack is poss…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T04:15:09.966Z. Updated 2026-08-31T22:04:43.880Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 05:04 WIB

Official record

LowPublished 30 Aug 2026, 09:52 WIB

CVE-2026-77846

JSON path injection via unescaped get_path segments in AshSqlite

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation builds the SQLite json_e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T02:52:12.562Z. Updated 2026-08-31T14:54:22.261Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:54 WIB

Official record

HighPublished 30 Aug 2026, 08:12 WIB

CVE-2026-75759

Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signed then encrypted, with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T01:12:43.435Z. Updated 2026-08-31T14:53:35.902Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:53 WIB

Official record

LowPublished 30 Aug 2026, 07:18 WIB

CVE-2026-77831

Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListCh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T00:18:38.078Z. Updated 2026-08-31T14:52:45.550Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:52 WIB

Official record

MedPublished 30 Aug 2026, 07:18 WIB

CVE-2026-77970

Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists. sensitive_attributes :redact and :ignore only act on the tracked resource's top-l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T00:18:22.853Z. Updated 2026-08-31T14:51:59.120Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:51 WIB

Official record

MedPublished 30 Aug 2026, 07:18 WIB

CVE-2026-75847

Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes. AshPaperTrail stores the values of tracked sensitive? attributes in the generated version resource's changes m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T00:18:05.390Z. Updated 2026-08-31T17:03:22.739Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:03 WIB

Official record

MedPublished 30 Aug 2026, 06:58 WIB

CVE-2026-82562

qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T23:58:31.289Z. Updated 2026-08-31T17:04:14.950Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:04 WIB

Official record

MedPublished 30 Aug 2026, 06:51 WIB

CVE-2026-82417

qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property

### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T23:51:27.634Z. Updated 2026-08-31T17:08:24.074Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:08 WIB

Official record

MedPublished 30 Aug 2026, 05:45 WIB

CVE-2026-82424

PHPGurukul Student Information System student_edit1.php sql injection

A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /student_edit1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T22:45:11.005Z. Updated 2026-08-31T17:10:41.805Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:10 WIB

Official record

MedPublished 30 Aug 2026, 05:15 WIB

CVE-2026-82423

macrozheng mall Payment Status Endpoint paySuccess behavioral workflow

A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T22:15:10.867Z. Updated 2026-09-01T02:17:29.639Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 09:17 WIB

Official record

MedPublished 30 Aug 2026, 04:45 WIB

CVE-2026-82422

itsourcecode Sales and Inventory System emp_del.php sql injection

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_del.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T21:45:09.789Z. Updated 2026-08-31T17:46:48.174Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:46 WIB

Official record

MedPublished 30 Aug 2026, 04:00 WIB

CVE-2026-82421

itsourcecode Sales and Inventory System emp_edit.php sql injection

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/emp_edit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T21:00:12.247Z. Updated 2026-08-31T18:34:45.718Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:34 WIB

Official record

CritPublished 30 Aug 2026, 02:26 WIB

CVE-2026-15369

Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T19:26:34.288Z. Updated 2026-09-01T02:15:41.417Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 09:15 WIB

Official record

HighPublished 30 Aug 2026, 00:25 WIB

CVE-2026-75807

SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T17:25:48.408Z. Updated 2026-08-31T18:10:18.791Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:10 WIB

Official record

MedPublished 29 Aug 2026, 23:35 WIB

CVE-2026-82476

Memos through 0.30.0 SSRF via Omitted CGNAT Address Range

Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T16:35:36.039Z. Updated 2026-08-31T18:13:31.780Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:13 WIB

Official record

HighPublished 29 Aug 2026, 23:35 WIB

CVE-2026-82475

iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T16:35:34.514Z. Updated 2026-09-01T02:14:34.540Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 09:14 WIB

Official record

HighPublished 29 Aug 2026, 23:35 WIB

CVE-2026-82474

Sudo through 1.9.17p2 Intercept Policy Bypass via execveat

Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T16:35:33.836Z. Updated 2026-09-02T17:57:15.670Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Sep 2026, 00:57 WIB

Official record