Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 4521–4540 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 08 Apr 2026, 00:09 WIB

CVE-2026-22682

OpenHarness Improper Access Control via File Tools

OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enforcement, allowing attackers who can influence agent tool execution to read arbitrary local files outside the intended repository scope. Attackers can expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T17:09:01.033Z. Updated 2026-07-14T15:53:30.823Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record

HighPublished 08 Apr 2026, 00:08 WIB

CVE-2026-35575

ChurchCRM has Stored XSS in Group Name

ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting (Stored XSS) vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator views the page. This …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 4521 to 4540 of 5813.First page Next page

Published 2026-04-07T17:08:43.354Z. Updated 2026-04-07T18:35:14.962Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 01:35 WIB

Official record

MedPublished 08 Apr 2026, 00:08 WIB

CVE-2026-22680

OpenViking < 0.3.3 Missing Authorization via Task Polling

OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T17:08:30.835Z. Updated 2026-10-08T15:22:17.245Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

HighPublished 08 Apr 2026, 00:07 WIB

CVE-2026-35572

SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts

ChurchCRM is an open-source church management system. Prior to 6.5.3, it is possible to trigger server-side HTTP/HTTPS requests to arbitrary hosts (SSRF) by supplying a crafted URL in the Referer request header. The server subsequently makes an outbound request to the attacker-controlled domain, confirmed via OAST. Thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T17:07:57.506Z. Updated 2026-04-07T19:59:43.438Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 02:59 WIB

Official record

CritPublished 08 Apr 2026, 00:06 WIB

CVE-2026-35573

ChurchCRM has a Path traversal leads to RCE

ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T17:06:07.161Z. Updated 2026-04-08T18:49:46.996Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 01:49 WIB

Official record

HighPublished 08 Apr 2026, 00:04 WIB

CVE-2026-35574

ChurchCRM has a Stored XSS in Person Profile - Add a Note

ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM's Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users' browsers, including administrators. This can lead…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T17:04:21.184Z. Updated 2026-04-07T17:26:30.431Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 00:26 WIB

Official record

MedPublished 08 Apr 2026, 00:00 WIB

CVE-2026-39316

CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDele…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T17:00:26.801Z. Updated 2026-04-09T15:42:40.861Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 22:42 WIB

Official record

MedPublished 07 Apr 2026, 23:59 WIB

CVE-2026-39314

CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-supporte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:59:23.808Z. Updated 2026-06-23T15:51:28.925Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 22:51 WIB

Official record

HighPublished 07 Apr 2026, 23:56 WIB

CVE-2026-35610

PolarLearn has a Server Action Admin Bypass in Account Management Actions

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userId, password) and deleteUser(userId) in the account-management module used an inverted admin check. Because of the inverted condition, authenticated non-admin users were allowed to execute both actions, while r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:56:57.483Z. Updated 2026-04-07T18:32:36.607Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 01:32 WIB

Official record

HighPublished 07 Apr 2026, 23:52 WIB

CVE-2026-39312

Pre-Auth EAP-TLS DoS on SoftEther VPN Developer Edition

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. In 5.2.5188 and earlier, a pre-authentication denial-of-service vulnerability exists in SoftEther VPN Developer Edition 5.2.5188 (and likely earlier versions of Developer Edition). An unauthenticated remote attacker can crash the vpnserver proc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:52:08.172Z. Updated 2026-04-07T17:27:16.498Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 00:27 WIB

Official record

CritPublished 07 Apr 2026, 23:50 WIB

CVE-2026-23696

Windmill < 1.603.3 File Ownership Handling SQLi RCE

Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:50:53.231Z. Updated 2026-07-14T15:53:34.268Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record

HighPublished 07 Apr 2026, 23:50 WIB

CVE-2026-22683

Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:50:30.297Z. Updated 2026-07-14T15:53:31.531Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record

HighPublished 07 Apr 2026, 23:49 WIB

CVE-2026-39307

PraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction

PraisonAI is a multi-agent teams system. Prior to 1.5.113, The PraisonAI templates installation feature is vulnerable to a "Zip Slip" Arbitrary File Write attack. When downloading and extracting template archives from external sources (e.g., GitHub), the application uses Python's zipfile.extractall() without verifying …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:49:29.885Z. Updated 2026-04-09T15:40:37.560Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 22:40 WIB

Official record

HighPublished 07 Apr 2026, 23:48 WIB

CVE-2026-39308

PraisonAI recipe registry publish path traversal allows out-of-root file write

PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry publish endpoint writes uploaded recipe bundles to a filesystem path derived from the bundle's internal manifest.json before it verifies that the manifest name and version match the HTTP route. A malicious publisher can place ../ tra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:48:42.322Z. Updated 2026-04-09T16:18:05.184Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:18 WIB

Official record

HighPublished 07 Apr 2026, 23:48 WIB

CVE-2026-39306

PraisonAI recipe registry pull path traversal writes files outside the chosen output directory

PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry pull flow extracts attacker-controlled .praison tar archives with tar.extractall() and does not validate archive member paths before extraction. A malicious publisher can upload a recipe bundle that contains ../ traversal entries and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:48:05.722Z. Updated 2026-04-07T18:31:31.939Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 01:31 WIB

Official record

CritPublished 07 Apr 2026, 23:47 WIB

CVE-2026-39305

Arbitrary File Write / Path Traversal in Action Orchestrator

PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or compromised agent) to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments (../) in the target path, malic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:47:18.102Z. Updated 2026-04-07T17:27:47.512Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 00:27 WIB

Official record

CritPublished 07 Apr 2026, 23:46 WIB

CVE-2026-35615

PraisonAI has a Path Traversal in FileTools

PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() first, which collapses .. sequences, then checks for '..' in normalized. Since .. is already collapsed, the check always passes. This makes the check completely useless and allows trivial path traversal to any file on t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:46:15.192Z. Updated 2026-04-09T16:18:10.919Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:18 WIB

Official record

UnscoredPublished 07 Apr 2026, 23:42 WIB

CVE-2026-32588

Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:42:52.361Z. Updated 2026-04-09T14:43:57.808Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Apr 2026, 21:43 WIB

Official record

CritPublished 07 Apr 2026, 23:42 WIB

CVE-2026-35614

Frappe has a SQL injection in bulk_update

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.14.0 and 15.104.0.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:42:12.740Z. Updated 2026-04-09T14:41:12.703Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated09 Apr 2026, 21:41 WIB

Official record

UnscoredPublished 07 Apr 2026, 23:40 WIB

CVE-2026-27315

Apache Cassandra: cqlsh history sensitive information leak

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via ~/.cassandra/cqlsh_history local file access. Users are recommended to upgrade to version 4.0.20, which fixes this issue. -- Description: Cassandra's command-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:40:51.836Z. Updated 2026-04-09T14:38:23.271Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Apr 2026, 21:38 WIB

Official record