Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 4541–4560 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 07 Apr 2026, 23:39 WIB

CVE-2026-35613

Path traversal in coursevault-preview due to improper base-directory boundary validation

coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:39:44.237Z. Updated 2026-04-09T16:18:16.501Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:18 WIB

Official record

HighPublished 07 Apr 2026, 23:38 WIB

CVE-2026-35611

Addressable has a Regular Expression Denial of Service in Addressable templates

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking. Templates using the * (expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 4541 to 4560 of 5813.First page Next page

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:38:08.707Z. Updated 2026-04-09T14:36:18.529Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 21:36 WIB

Official record

MedPublished 07 Apr 2026, 23:35 WIB

CVE-2026-35608

QuickDrop has stored XSS in SVG file preview endpoint allowing JavaScript execution

QuickDrop is an easy-to-use file sharing application. Prior to 1.5.3, a stored XSS vulnerability exists in the file preview endpoint. The application allows SVG files to be uploaded via the /api/file/upload-chunk endpoint. An attacker can upload a specially crafted SVG file containing a JavaScript payload. When any use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:35:08.606Z. Updated 2026-04-07T18:30:02.117Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 01:30 WIB

Official record

HighPublished 07 Apr 2026, 23:34 WIB

CVE-2025-14821

Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows

A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:34:10.718Z. Updated 2026-08-31T11:48:10.712Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 18:48 WIB

Official record

UnscoredPublished 07 Apr 2026, 23:33 WIB

CVE-2026-27314

Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only CREATE permission to associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via ADD IDENTITY. Users are recommended to upgrade to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:33:44.448Z. Updated 2026-04-08T03:55:52.335Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Apr 2026, 10:55 WIB

Official record

HighPublished 07 Apr 2026, 23:31 WIB

CVE-2026-35607

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 ("self-registered users don't get execute perms") stripped Execute permission and Commands from users created via the signup handler. The sa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:31:21.522Z. Updated 2026-04-08T18:50:24.867Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 01:50 WIB

Official record

CritPublished 07 Apr 2026, 23:30 WIB

CVE-2026-4631

Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:30:28.069Z. Updated 2026-10-15T18:54:51.164Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 01:54 WIB

Official record

MedPublished 07 Apr 2026, 23:29 WIB

CVE-2026-35606

File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoint…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:29:03.565Z. Updated 2026-04-09T16:18:22.881Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:18 WIB

Official record

MedPublished 07 Apr 2026, 23:26 WIB

CVE-2025-14944

Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage

The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:26:24.676Z. Updated 2026-04-08T17:12:41.782Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:12 WIB

Official record

MedPublished 07 Apr 2026, 23:24 WIB

CVE-2026-35605

File Browser has an access rule bypass via HasPrefix without trailing separator in path matching

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator when matching paths against access rules. A rule for /uploads…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:24:52.307Z. Updated 2026-04-09T14:32:02.764Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated09 Apr 2026, 21:32 WIB

Official record

HighPublished 07 Apr 2026, 23:22 WIB

CVE-2026-35604

File Browser share links remain accessible after Share/Download permissions are revoked

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:22:51.557Z. Updated 2026-04-07T18:26:43.881Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 01:26 WIB

Official record

HighPublished 07 Apr 2026, 23:20 WIB

CVE-2026-35585

File Browser has a Command Injection via Hook Runner

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete — is vulnerable to OS …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:20:46.019Z. Updated 2026-06-09T11:49:46.912Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated09 Jun 2026, 18:49 WIB

Official record

MedPublished 07 Apr 2026, 23:11 WIB

CVE-2026-35592

pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs character-level string comparison rather than path-level comparison. This allows…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:11:38.209Z. Updated 2026-04-08T14:58:21.343Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 21:58 WIB

Official record

MedPublished 07 Apr 2026, 23:09 WIB

CVE-2026-35586

Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses incorrect option names ssl_cert and ssl_key, while the actual configuration option names are ssl_certfile and ssl_keyfile. This name mismatch causes the a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:09:11.856Z. Updated 2026-04-07T18:16:14.387Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 01:16 WIB

Official record

MedPublished 07 Apr 2026, 23:07 WIB

CVE-2026-35584

FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:07:33.883Z. Updated 2026-04-09T14:29:09.627Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Apr 2026, 21:29 WIB

Official record

HighPublished 07 Apr 2026, 23:05 WIB

CVE-2026-39384

FreeScout Customer Merge Cross-Mailbox Authorization Bypass

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T16:05:16.793Z. Updated 2026-04-09T16:18:45.817Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:18 WIB

Official record

HighPublished 07 Apr 2026, 22:58 WIB

CVE-2026-35523

Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol

Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init handshake has been completed before processing start (subscriptio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T15:58:17.694Z. Updated 2026-04-09T16:18:51.112Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:18 WIB

Official record

MedPublished 07 Apr 2026, 22:57 WIB

CVE-2026-35583

Emissary has a Path Traversal via Blacklist Bypass in Configuration API

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T15:57:41.496Z. Updated 2026-04-09T16:18:56.328Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 23:18 WIB

Official record

HighPublished 07 Apr 2026, 22:56 WIB

CVE-2026-35581

Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T15:56:55.838Z. Updated 2026-04-08T14:57:47.316Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 21:57 WIB

Official record

CritPublished 07 Apr 2026, 22:55 WIB

CVE-2026-35580

Emissary has GitHub Actions Shell Injection via Workflow Inputs

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-07T15:55:56.074Z. Updated 2026-04-07T18:25:26.662Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 01:25 WIB

Official record