Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 4721–4740 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 07 Apr 2026, 03:17 WIB

CVE-2026-35391

Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker could forge their source IP address to bypass IP-based rate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T20:17:39.793Z. Updated 2026-04-07T15:09:49.591Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 22:09 WIB

Official record

MedPublished 07 Apr 2026, 03:13 WIB

CVE-2026-35390

Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the reverse proxy (proxy.ts) set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This means cross-site scripting (XSS) attacks were logged but not blocked. Any user who coul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 4721 to 4740 of 5813.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T20:13:30.093Z. Updated 2026-04-07T19:33:05.084Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 02:33 WIB

Official record

HighPublished 07 Apr 2026, 03:11 WIB

CVE-2026-35389

Bulwark Webmail S/MIME signature verification accepted self-signed certificates

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate was displayed as having a valid signature. This vulnerability is fixed i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T20:11:56.827Z. Updated 2026-04-07T16:19:51.168Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 23:19 WIB

Official record

HighPublished 07 Apr 2026, 03:08 WIB

CVE-2026-35213

Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing

@hapi/content provided HTTP Content-* headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrop…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T20:08:54.811Z. Updated 2026-06-23T15:51:14.160Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 22:51 WIB

Official record

MedPublished 07 Apr 2026, 03:06 WIB

CVE-2026-35208

lichess.org has an Unsanitized Stream Title Injection on /streamer

lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live streams” widget by placing markup in their Twitch/YouTube stream title. CSP is present and blocks inline script execution, but the issue is still a server-side HTML…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T20:06:25.821Z. Updated 2026-04-07T15:09:55.304Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 22:09 WIB

Official record

HighPublished 07 Apr 2026, 02:54 WIB

CVE-2026-35203

ZLMediaKit VP9 RTP Parser Out-of-Bounds Read

ZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag bits in the first byte, without verifying that sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:54:45.052Z. Updated 2026-04-07T19:30:51.437Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 02:30 WIB

Official record

MedPublished 07 Apr 2026, 02:49 WIB

CVE-2026-35201

Discount has an Out-of-bounds Read in rdiscount

Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:49:48.806Z. Updated 2026-04-07T16:21:14.803Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 23:21 WIB

Official record

LowPublished 07 Apr 2026, 02:47 WIB

CVE-2026-35200

Parse Server has a file upload Content-Type override via extension mismatch

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist (e.g., .txt) but with a Content-Type header that differs from the extension (e.g., text/htm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:47:27.709Z. Updated 2026-04-07T14:02:50.601Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

MedPublished 07 Apr 2026, 02:45 WIB

CVE-2026-5682

Meesho Online Shopping App com.meesho.supply endpoint risky encryption

A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoint of the component com.meesho.supply. Such manipulation leads to risky cryptographic algorithm. The attack may be performed from remote. The attack requires a high level of complex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:45:14.504Z. Updated 2026-04-07T13:37:44.226Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 20:37 WIB

Official record

MedPublished 07 Apr 2026, 02:44 WIB

CVE-2026-35199

SymCrypt SymCryptXmssSign function - Heap overflow via 64->32-bit leaf-count truncation

SymCrypt is the core cryptographic function library currently used by Windows. From 103.5.0 to before 103.11.0, The SymCryptXmssSign function passes a 64-bit leaf count value to a helper function that accepts a 32-bit parameter. For XMSS^MT parameter sets with total tree height >= 32 (which includes standard predefined…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:44:31.143Z. Updated 2026-04-07T15:10:00.886Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 22:10 WIB

Official record

MedPublished 07 Apr 2026, 02:39 WIB

CVE-2026-35197

Code injection in dye template expressions

dye is a portable and respectful color library for shell scripts. Prior to 1.1.1, certain dye template expressions would result in execution of arbitrary code. This issue was discovered and fixed by dye's author, and is not known to be exploited. This vulnerability is fixed in 1.1.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:39:23.095Z. Updated 2026-04-07T16:11:34.861Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 23:11 WIB

Official record

CritPublished 07 Apr 2026, 02:37 WIB

CVE-2026-35459

pyLoad has SSRF fix bypass via HTTP redirect

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to BaseDownloader.download() that checks the hostname of the initial download URL. However, pycurl is configure…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:37:00.598Z. Updated 2026-04-07T19:29:49.223Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 02:29 WIB

Official record

HighPublished 07 Apr 2026, 02:33 WIB

CVE-2026-35187

pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:33:06.557Z. Updated 2026-04-07T14:03:28.344Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

HighPublished 07 Apr 2026, 02:24 WIB

CVE-2026-35185

HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:24:57.425Z. Updated 2026-04-07T15:10:10.078Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 22:10 WIB

Official record

HighPublished 07 Apr 2026, 02:21 WIB

CVE-2026-35184

EcclesiaCRM has a Critical SQL Injection

EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters. This vulnerability is fixed in 8.0.0.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:21:22.597Z. Updated 2026-04-07T19:25:50.870Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Apr 2026, 02:25 WIB

Official record

MedPublished 07 Apr 2026, 02:15 WIB

CVE-2026-5681

itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection

A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument emp_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been published …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:15:12.127Z. Updated 2026-04-07T16:12:51.633Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 23:12 WIB

Official record

HighPublished 07 Apr 2026, 02:11 WIB

CVE-2026-35183

Brave CMS has an Insecure Direct Object Reference in Article Image Deletion

Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ow…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:11:28.807Z. Updated 2026-04-07T16:14:01.519Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 23:14 WIB

Official record

HighPublished 07 Apr 2026, 02:10 WIB

CVE-2026-35182

Missing Authorization Privilege Escalation

Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to change account roles an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:10:28.850Z. Updated 2026-04-07T14:04:00.456Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:04 WIB

Official record

MedPublished 07 Apr 2026, 02:09 WIB

CVE-2026-35181

WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:09:45.204Z. Updated 2026-04-07T15:10:15.182Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 22:10 WIB

Official record

HighPublished 07 Apr 2026, 02:08 WIB

CVE-2026-35172

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leave…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-06T19:08:44.512Z. Updated 2026-09-09T12:04:57.565Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated09 Sep 2026, 19:04 WIB

Official record