Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 461–480 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 29 Mar 2026, 05:30 WIB

CVE-2026-5017

code-projects Simple Food Order System Parameter all-tickets.php sql injection

A security flaw has been discovered in code-projects Simple Food Order System 1.0. This impacts an unknown function of the file /all-tickets.php of the component Parameter Handler. Performing a manipulation of the argument Status results in sql injection. The attack can be initiated remotely. The exploit has been relea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T22:30:12.864Z. Updated 2026-03-30T14:52:56.572Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:52 WIB

Official record

MedPublished 29 Mar 2026, 04:45 WIB

CVE-2026-5016

elecV2 elecV2P URL mock eAxios server-side request forgery

A vulnerability was identified in elecV2 elecV2P up to 3.8.3. This affects the function eAxios of the file /mock of the component URL Handler. Such manipulation of the argument req leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 461 to 480 of 6236.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T21:45:11.240Z. Updated 2026-03-30T14:32:46.143Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:32 WIB

Official record

MedPublished 29 Mar 2026, 04:00 WIB

CVE-2026-5015

elecV2 elecV2P Endpoint logs cross site scripting

A vulnerability was determined in elecV2 elecV2P up to 3.8.3. The impacted element is an unknown function of the file /logs of the component Endpoint. This manipulation of the argument filename causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T21:00:16.752Z. Updated 2026-04-01T14:16:08.468Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 21:16 WIB

Official record

MedPublished 29 Mar 2026, 04:00 WIB

CVE-2026-5014

elecV2 elecV2P Wildcard log path.join path traversal

A vulnerability was found in elecV2 elecV2P up to 3.8.3. The affected element is the function path.join of the file /log/ of the component Wildcard Handler. The manipulation results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T21:00:13.930Z. Updated 2026-03-30T16:00:42.594Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 23:00 WIB

Official record

MedPublished 29 Mar 2026, 03:00 WIB

CVE-2026-5013

elecV2 elecV2P :key path.join path traversal

A vulnerability has been found in elecV2 elecV2P up to 3.8.3. Impacted is the function path.join of the file /store/:key. The manipulation of the argument URL leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T20:00:13.760Z. Updated 2026-03-30T15:55:15.514Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:55 WIB

Official record

MedPublished 29 Mar 2026, 02:15 WIB

CVE-2026-5012

elecV2 elecV2P rpc pm2run os command injection

A flaw has been found in elecV2 elecV2P up to 3.8.3. This issue affects the function pm2run of the file /rpc. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue rep…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T19:15:11.947Z. Updated 2026-03-30T14:53:04.134Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:53 WIB

Official record

UnscoredPublished 29 Mar 2026, 01:52 WIB

CVE-2026-3256

HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids

HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T18:52:39.917Z. Updated 2026-06-29T06:50:16.274Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jun 2026, 13:50 WIB

Official record

UnscoredPublished 29 Mar 2026, 01:43 WIB

CVE-2025-15604

Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions

Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. In versions 6.06 through 6.16, the random_string function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes by concatenating a SHA-1 hash seeded with the bu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T18:43:56.318Z. Updated 2026-04-01T14:13:01.746Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Apr 2026, 21:13 WIB

Official record

MedPublished 29 Mar 2026, 01:30 WIB

CVE-2026-5011

elecV2 elecV2P JSON webhook runJSFile code injection

A vulnerability was detected in elecV2 elecV2P up to 3.8.3. This vulnerability affects the function runJSFile of the file /webhook of the component JSON Parser. Performing a manipulation of the argument rawcode results in code injection. Remote exploitation of the attack is possible. The exploit is now public and may b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T18:30:15.469Z. Updated 2026-03-30T14:37:01.524Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:37 WIB

Official record

MedPublished 29 Mar 2026, 01:30 WIB

CVE-2026-5007

kazuph mcp-docs-rag add_git_repository/add_text_file index.ts cloneRepository os command injection

A vulnerability was identified in kazuph mcp-docs-rag up to 0.5.0. Affected is the function cloneRepository of the file src/index.ts of the component add_git_repository/add_text_file. The manipulation leads to os command injection. The attack needs to be performed locally. The exploit is publicly available and might be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T18:30:12.170Z. Updated 2026-04-01T14:10:05.012Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 21:10 WIB

Official record

HighPublished 29 Mar 2026, 00:30 WIB

CVE-2026-5004

Wavlink WL-WN579X3-C UPNP firewall.cgi sub_4019FC stack-based overflow

A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This impacts the function sub_4019FC of the file /cgi-bin/firewall.cgi of the component UPNP Handler. Executing a manipulation of the argument UpnpEnabled can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T17:30:12.944Z. Updated 2026-03-30T16:01:33.373Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 23:01 WIB

Official record

MedPublished 29 Mar 2026, 00:30 WIB

CVE-2026-5003

PromtEngineer localGPT Web api_server.py handle_index information disclosure

A vulnerability was found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. This affects the function handle_index of the file rag_system/api_server.py of the component Web Interface. Performing a manipulation results in information disclosure. It is possible to initiate the attack remotely. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T17:30:10.521Z. Updated 2026-03-30T15:54:08.127Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:54 WIB

Official record

MedPublished 28 Mar 2026, 23:45 WIB

CVE-2026-5002

PromtEngineer localGPT LLM Prompt server.py _route_using_overviews injection

A vulnerability has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The impacted element is the function _route_using_overviews of the file backend/server.py of the component LLM Prompt Handler. Such manipulation leads to injection. The attack may be performed from remote. The explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T16:45:09.689Z. Updated 2026-03-30T14:53:10.304Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:53 WIB

Official record

MedPublished 28 Mar 2026, 23:00 WIB

CVE-2026-5001

PromtEngineer localGPT server.py do_POST unrestricted upload

A flaw has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The affected element is the function do_POST of the file backend/server.py. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T16:00:14.786Z. Updated 2026-03-30T14:38:48.529Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:38 WIB

Official record

MedPublished 28 Mar 2026, 22:00 WIB

CVE-2026-5000

PromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authentication

A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Impacted is the function LocalGPTHandler of the file backend/server.py of the component API Endpoint. The manipulation of the argument BaseHTTPRequestHandler results in missing authentication. The attack can be execut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T15:00:16.421Z. Updated 2026-04-01T14:06:09.042Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 21:06 WIB

Official record

MedPublished 28 Mar 2026, 22:00 WIB

CVE-2026-4999

z-9527 admin isImg Check upload.js uploadFile path traversal

A security vulnerability has been detected in z-9527 admin up to 72aaf2dd05cf4ec2e98f390668b41e128eec5ad2. This issue affects the function uploadFile of the file /server/utils/upload.js of the component isImg Check. The manipulation of the argument fileType leads to path traversal. Remote exploitation of the attack is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T15:00:13.780Z. Updated 2026-03-30T17:11:58.812Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 00:11 WIB

Official record

MedPublished 28 Mar 2026, 20:15 WIB

CVE-2026-4998

Sinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injection

A weakness has been identified in Sinaptik AI PandasAI up to 3.0.0. This vulnerability affects the function CodeExecutor.execute of the file pandasai/core/code_execution/code_executor.py of the component Chat Message Handler. Executing a manipulation can lead to code injection. The attack may be launched remotely. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T13:15:12.663Z. Updated 2026-03-30T15:49:24.355Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:49 WIB

Official record

MedPublished 28 Mar 2026, 19:23 WIB

CVE-2026-4997

Sinaptik AI PandasAI sql_sanitizer.py is_sql_query_safe path traversal

A security flaw has been discovered in Sinaptik AI PandasAI up to 3.0.0. This affects the function is_sql_query_safe of the file pandasai/helpers/sql_sanitizer.py. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T12:23:10.126Z. Updated 2026-03-30T14:53:16.850Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:53 WIB

Official record

HighPublished 28 Mar 2026, 19:00 WIB

CVE-2017-20228

Flat Assembler 1.71.21 Stack-Based Buffer Overflow ROP

Flat Assembler 1.71.21 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying oversized input to the application. Attackers can craft malicious assembly input exceeding 5895 bytes to overwrite the instruction pointer and execute return-oriented programmin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T12:00:07.748Z. Updated 2026-10-01T15:19:00.746Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

HighPublished 28 Mar 2026, 18:58 WIB

CVE-2018-25225

SIPP 3.3 Stack-Based Buffer Overflow via Configuration File

SIPP 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious input in the configuration file. Attackers can craft a configuration file with oversized values that overflow a stack buffer, overwriting the return address and exec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-28T11:58:17.188Z. Updated 2026-03-30T14:07:37.759Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:07 WIB

Official record