Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 19 KEV · 15,829 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 19
With a forecast: 15,829
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 98% · unscored 22%.

Showing 441–460 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118757

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:24.955Z. Updated 2026-10-28T21:11:24.955Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

MedPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118756

gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's rec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 441 to 460 of 16156.First page Next page

Severity medium: primary CNA CVSS 6.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:24.270Z. Updated 2026-10-28T21:11:24.270Z.

CVSS6.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

HighPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118755

Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:23.608Z. Updated 2026-10-28T21:11:23.608Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

MedPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118754

Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:22.905Z. Updated 2026-10-28T21:11:22.905Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

HighPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118753

FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing

FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame()…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:22.192Z. Updated 2026-10-28T21:11:22.192Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

HighPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118752

FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:21.485Z. Updated 2026-10-28T21:11:21.485Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

HighPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118694

python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume qu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:20.814Z. Updated 2026-10-28T21:11:20.814Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

MedPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118693

CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:20.057Z. Updated 2026-10-28T21:11:20.057Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

HighPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118692

CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:19.351Z. Updated 2026-10-28T21:11:19.351Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

MedPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118691

xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message

xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:18.629Z. Updated 2026-10-28T21:11:18.629Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

CritPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118690

Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:17.919Z. Updated 2026-10-28T21:11:17.919Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

HighPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118689

OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate bu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:17.232Z. Updated 2026-10-28T21:11:17.232Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

HighPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118682

ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achievin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:16.509Z. Updated 2026-10-28T21:11:16.509Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record

HighPublished 29 Oct 2026, 04:09 WIB

CVE-2026-118669

OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:09:58.893Z. Updated 2026-10-28T21:09:58.893Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:09 WIB

Official record

HighPublished 29 Oct 2026, 04:06 WIB

CVE-2026-118668

LangGraph JavaScript custom authentication may permit cross-user Store access

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operation. An authenticated use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:06:43.157Z. Updated 2026-10-28T21:06:43.157Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:06 WIB

Official record

MedPublished 29 Oct 2026, 03:51 WIB

CVE-2026-118667

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the synchronous and asynchronou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:51:46.657Z. Updated 2026-10-28T20:51:46.657Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:51 WIB

Official record

MedPublished 29 Oct 2026, 03:45 WIB

CVE-2026-118666

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessage handler whenever a ne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:45:58.056Z. Updated 2026-10-28T20:45:58.056Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:45 WIB

Official record

HighPublished 29 Oct 2026, 03:41 WIB

CVE-2026-118665

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionPa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:41:47.228Z. Updated 2026-10-28T20:41:47.228Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:41 WIB

Official record

HighPublished 29 Oct 2026, 03:37 WIB

CVE-2026-118664

decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:37:19.057Z. Updated 2026-10-28T20:37:19.057Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:37 WIB

Official record

MedPublished 29 Oct 2026, 03:35 WIB

CVE-2026-118663

@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a diffe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:35:22.948Z. Updated 2026-10-28T20:35:22.948Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:35 WIB

Official record