Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4621–4640 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 19 Aug 2026, 04:21 WIB

CVE-2026-62291

libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_ch…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:21:32.182Z. Updated 2026-08-21T19:11:12.114Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:11 WIB

Official record

HighPublished 19 Aug 2026, 04:20 WIB

CVE-2026-62292

libheif: Out-of-bounds read in uncompressed unci tile range slicing

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 4621 to 4640 of 12259.First page Next page

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:20:24.933Z. Updated 2026-08-25T01:43:35.289Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 08:43 WIB

Official record

MedPublished 19 Aug 2026, 04:19 WIB

CVE-2026-62289

libheif: Integer underflow in Fraction constructor via double clap transform application

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:19:18.107Z. Updated 2026-08-19T16:51:42.360Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:51 WIB

Official record

HighPublished 19 Aug 2026, 04:18 WIB

CVE-2026-50142

libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seq_boxes.cc, Box_stsz::parse() applies max_sequence_frames only to variable-si…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:18:03.652Z. Updated 2026-08-19T18:51:48.615Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:51 WIB

Official record

MedPublished 19 Aug 2026, 04:17 WIB

CVE-2026-48796

CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundation applications. Prior to version 148.0.90, CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs used filePath.StartsWith(rootFolder, StringComparison.OrdinalIgnoreCase) to decide whether a decoded and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:17:16.861Z. Updated 2026-08-19T18:19:59.005Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:19 WIB

Official record

MedPublished 19 Aug 2026, 04:15 WIB

CVE-2026-73974

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test() treated the first or second elem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:15:03.324Z. Updated 2026-08-19T17:09:41.147Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 00:09 WIB

Official record

MedPublished 19 Aug 2026, 04:12 WIB

CVE-2026-73973

Linuxfabrik Monitoring Plugins: Arbitrary root file disclosure via unconfined --filename in logfile plugin (sudoers LPE)

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-form --filename path and opened it as root when invoked through the shipped nagios or icinga sudoers allowlist, without confining the resolved path to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:12:27.664Z. Updated 2026-08-19T19:20:04.354Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:20 WIB

Official record

MedPublished 19 Aug 2026, 04:09 WIB

CVE-2026-41921

Koha Stored XSS via Purchase Suggestion Handler

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script conten…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:09:48.910Z. Updated 2026-10-01T15:20:00.430Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:20 WIB

Official record

HighPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73939

CVE-2026-73939

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:15.894Z. Updated 2026-08-28T04:21:59.835Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 11:21 WIB

Official record

HighPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73938

CVE-2026-73938

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:15.591Z. Updated 2026-08-28T17:20:53.862Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 00:20 WIB

Official record

HighPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73937

CVE-2026-73937

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:15.282Z. Updated 2026-08-28T04:30:02.571Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 11:30 WIB

Official record

HighPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73936

CVE-2026-73936

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:14.972Z. Updated 2026-08-28T17:19:05.988Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 00:19 WIB

Official record

HighPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73935

CVE-2026-73935

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:14.649Z. Updated 2026-08-28T17:23:39.209Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 00:23 WIB

Official record

HighPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73934

CVE-2026-73934

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:14.335Z. Updated 2026-08-28T17:23:00.429Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 00:23 WIB

Official record

HighPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73933

CVE-2026-73933

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:13.998Z. Updated 2026-08-28T17:33:08.192Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 00:33 WIB

Official record

MedPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73932

CVE-2026-73932

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:13.666Z. Updated 2026-08-28T18:33:09.478Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:33 WIB

Official record

HighPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73931

CVE-2026-73931

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:13.352Z. Updated 2026-08-28T04:27:42.568Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 11:27 WIB

Official record

CritPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73930

CVE-2026-73930

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.19 and 4.0.0-4.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:13.029Z. Updated 2026-08-27T21:29:51.959Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 04:29 WIB

Official record

HighPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73929

CVE-2026-73929

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:12.699Z. Updated 2026-08-28T04:23:41.084Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 11:23 WIB

Official record

HighPublished 19 Aug 2026, 04:04 WIB

CVE-2026-73928

CVE-2026-73928

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T21:04:12.375Z. Updated 2026-08-28T17:36:17.469Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 00:36 WIB

Official record