Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 4461–4480 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 08 Apr 2026, 02:37 WIB

CVE-2026-39374

Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint

Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID without f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:37:31.834Z. Updated 2026-04-08T14:35:28.762Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 21:35 WIB

Official record

MedPublished 08 Apr 2026, 02:35 WIB

CVE-2026-39840

CSS injection in multiple Cargo display formats

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 4461 to 4480 of 5813.First page Next page

Published 2026-04-07T19:35:36.153Z. Updated 2026-04-07T20:42:42.943Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 03:42 WIB

Official record

MedPublished 08 Apr 2026, 02:35 WIB

CVE-2026-39373

JWCrypto: JWE ZIP decompression bomb

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:35:36.071Z. Updated 2026-04-07T20:22:57.790Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 03:22 WIB

Official record

MedPublished 08 Apr 2026, 02:29 WIB

CVE-2026-39839

Stored XSS through URLs in Cargo's map format

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:29:11.025Z. Updated 2026-04-07T20:42:43.130Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 03:42 WIB

Official record

HighPublished 08 Apr 2026, 02:28 WIB

CVE-2026-39371

RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:28:30.941Z. Updated 2026-04-08T17:46:55.661Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:46 WIB

Official record

HighPublished 08 Apr 2026, 02:26 WIB

CVE-2026-39370

WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then fetches the response and s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:26:27.478Z. Updated 2026-04-08T19:22:58.480Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 02:22 WIB

Official record

HighPublished 08 Apr 2026, 02:24 WIB

CVE-2026-39369

WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:24:33.421Z. Updated 2026-05-14T16:05:11.967Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated14 May 2026, 23:05 WIB

Official record

MedPublished 08 Apr 2026, 02:23 WIB

CVE-2026-39368

WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming per…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:23:29.790Z. Updated 2026-04-07T20:02:21.185Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 03:02 WIB

Official record

MedPublished 08 Apr 2026, 02:22 WIB

CVE-2026-39367

WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:22:07.732Z. Updated 2026-04-08T17:47:40.548Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:47 WIB

Official record

MedPublished 08 Apr 2026, 02:21 WIB

CVE-2026-39366

WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:21:12.156Z. Updated 2026-04-08T19:23:04.265Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 02:23 WIB

Official record

MedPublished 08 Apr 2026, 02:17 WIB

CVE-2026-39838

ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:17:51.638Z. Updated 2026-04-08T18:48:41.035Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Apr 2026, 01:48 WIB

Official record

MedPublished 08 Apr 2026, 02:15 WIB

CVE-2026-5739

PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection

A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2. The affected element is the function GroovyEvaluator.evaluate of the file /openApi/addWorkflowNode of the component OpenAPI Endpoint. The manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:15:11.183Z. Updated 2026-04-07T20:03:03.560Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 03:03 WIB

Official record

MedPublished 08 Apr 2026, 02:13 WIB

CVE-2026-39365

Vite has a Path Traversal in Optimized Deps `.map` Handling

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow li…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:13:50.927Z. Updated 2026-04-15T14:23:24.501Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated15 Apr 2026, 21:23 WIB

Official record

HighPublished 08 Apr 2026, 02:12 WIB

CVE-2026-39364

Vite has a `server.fs.deny` bypass with queries

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnera…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:12:47.577Z. Updated 2026-08-17T12:05:13.339Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 19:05 WIB

Official record

HighPublished 08 Apr 2026, 02:10 WIB

CVE-2026-39363

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:10:44.916Z. Updated 2026-08-25T12:05:41.283Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 19:05 WIB

Official record

CritPublished 08 Apr 2026, 02:03 WIB

CVE-2026-39322

PolarLearn: Any password authenticates banned accounts and grants API access

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, POST /api/v1/auth/sign-in creates a valid session for banned accounts before verifying the supplied password. That session is then accepted across authenticated /api routes, enabling account data access and authenticated actions as t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:03:28.999Z. Updated 2026-04-09T16:16:51.970Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:16 WIB

Official record

HighPublished 08 Apr 2026, 02:02 WIB

CVE-2026-39361

OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url

OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T19:02:12.816Z. Updated 2026-04-09T16:17:46.139Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:17 WIB

Official record

MedPublished 08 Apr 2026, 01:58 WIB

CVE-2026-39360

RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

RustFS is a distributed object storage system built in Rust. Prior to alpha.90, RustFS contains a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can still exfiltrate victim objects by copying them into an attacker-controlled mu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T18:58:29.974Z. Updated 2026-04-07T19:28:22.541Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 02:28 WIB

Official record

CritPublished 08 Apr 2026, 01:56 WIB

CVE-2026-39355

Genealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)

Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticated user to transfer ownership of arbitrary non-personal teams to themselves. This enables complete takeover of other users’ team workspaces and unrestricted acces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T18:56:06.385Z. Updated 2026-04-08T18:10:34.141Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 01:10 WIB

Official record

MedPublished 08 Apr 2026, 01:54 WIB

CVE-2026-39354

Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.66.2, an authenticated authorization flaw in Scoold allows any logged-in, low-privilege user to overwrite another user's existing question by supplying that question's public ID as the postId parameter to POST /questions/ask. Because question IDs ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T18:54:36.133Z. Updated 2026-04-09T16:17:51.713Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:17 WIB

Official record