Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 19 KEV · 15,829 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 19
With a forecast: 15,829
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 98% · unscored 22%.

Showing 461–480 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 29 Oct 2026, 03:33 WIB

CVE-2026-118662

Vite: `server.fs.deny` bypassed with queries

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:33:36.440Z. Updated 2026-10-28T20:33:36.440Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:33 WIB

Official record

MedPublished 29 Oct 2026, 03:30 WIB

CVE-2026-118661

Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 461 to 480 of 16156.First page Next page

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:30:23.868Z. Updated 2026-10-28T20:30:23.868Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:30 WIB

Official record

HighPublished 29 Oct 2026, 03:23 WIB

CVE-2026-118660

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:23:10.122Z. Updated 2026-10-28T20:23:10.122Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:23 WIB

Official record

HighPublished 29 Oct 2026, 03:20 WIB

CVE-2026-118659

@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in package…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:20:29.561Z. Updated 2026-10-28T20:20:29.561Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:20 WIB

Official record

MedPublished 29 Oct 2026, 03:17 WIB

CVE-2026-118658

Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:17:11.083Z. Updated 2026-10-28T20:17:11.083Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:17 WIB

Official record

MedPublished 29 Oct 2026, 03:14 WIB

CVE-2026-118657

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-ter…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:14:09.883Z. Updated 2026-10-28T20:14:09.883Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:14 WIB

Official record

MedPublished 29 Oct 2026, 03:12 WIB

CVE-2026-118656

Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:12:13.757Z. Updated 2026-10-28T20:12:13.757Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:12 WIB

Official record

HighKEVPublished 29 Oct 2026, 03:05 WIB

CVE-2026-76418

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2026-10-28T20:05:31.926Z. Updated 2026-10-29T03:57:11.195Z.

CVSS8.6v3.1KEVListedEPSSPresentUpdated29 Oct 2026, 10:57 WIB

Official record

MedPublished 29 Oct 2026, 03:03 WIB

CVE-2026-118655

Echo: Static Middleware Double-Unescape Path Traversal

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:03:56.897Z. Updated 2026-10-28T20:03:56.897Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:03 WIB

Official record

CritPublished 29 Oct 2026, 03:02 WIB

CVE-2026-117574

Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T20:02:14.895Z. Updated 2026-10-28T20:02:14.895Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:02 WIB

Official record

MedPublished 29 Oct 2026, 02:59 WIB

CVE-2026-118654

Echo static file middleware route protection bypass via encoded dot-dot traversal

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an applicati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:59:27.911Z. Updated 2026-10-28T19:59:27.911Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:59 WIB

Official record

HighPublished 29 Oct 2026, 02:52 WIB

CVE-2026-13451

Kserve: kserve: server-side request forgery via malicious storageuri

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `storageUri`. This Server-Side Request Forgery (SSRF) vulnerability allows the `storage-initializer` init container to issue arbitrary outbound …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:52:51.913Z. Updated 2026-10-28T19:52:51.913Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:52 WIB

Official record

HighPublished 29 Oct 2026, 02:48 WIB

CVE-2026-61542

Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools

Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional `--mcp-http` mode that accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation and logging. In the described …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:48:42.991Z. Updated 2026-10-28T19:48:42.991Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:48 WIB

Official record

MedPublished 29 Oct 2026, 02:44 WIB

CVE-2026-54162

Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI

Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote clien…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:44:41.999Z. Updated 2026-10-28T19:44:41.999Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:44 WIB

Official record

MedPublished 29 Oct 2026, 02:43 WIB

CVE-2026-61529

Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint stores attacker-controlled `JsonData` after checking only that the JSON is well formed. A file object with `name`, `type` and `content` fields can contain an HTTP o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:43:17.490Z. Updated 2026-10-28T19:43:17.490Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:43 WIB

Official record

MedPublished 29 Oct 2026, 02:42 WIB

CVE-2026-118653

Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:42:05.556Z. Updated 2026-10-28T19:42:05.556Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:42 WIB

Official record

MedPublished 29 Oct 2026, 02:35 WIB

CVE-2026-118652

Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:35:47.103Z. Updated 2026-10-28T19:35:47.103Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:35 WIB

Official record

MedPublished 29 Oct 2026, 02:33 WIB

CVE-2026-115415

Secret masking bypass in the environment tool in Strands Agents Tools

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking. To reme…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:33:10.542Z. Updated 2026-10-28T19:37:36.733Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:37 WIB

Official record

MedPublished 29 Oct 2026, 02:30 WIB

CVE-2026-118651

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:30:01.320Z. Updated 2026-10-28T19:31:47.851Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:31 WIB

Official record

CritPublished 29 Oct 2026, 02:28 WIB

CVE-2026-63190

FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development serve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:28:00.080Z. Updated 2026-10-28T19:28:00.080Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:28 WIB

Official record