Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 481–500 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

LowPublished 30 Sep 2026, 18:30 WIB

CVE-2026-103012

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T11:30:38.308Z. Updated 2026-09-30T14:28:45.094Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:28 WIB

Official record

MedPublished 30 Sep 2026, 18:15 WIB

CVE-2026-103114

OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection

A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack rem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 481 to 500 of 14934.First page Next page

Published 2026-09-30T11:15:08.987Z. Updated 2026-09-30T13:47:09.418Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:47 WIB

Official record

HighPublished 30 Sep 2026, 18:07 WIB

CVE-2026-76992

Uncontrolled Memory Allocation in CODESYS Gateway Client

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus lead…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T11:07:45.751Z. Updated 2026-09-30T15:28:07.834Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

MedPublished 30 Sep 2026, 18:06 WIB

CVE-2026-13720

Editor can forge file-provisioning provenance on dashboards via the dashboard API

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T11:06:38.177Z. Updated 2026-09-30T15:28:07.969Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

MedPublished 30 Sep 2026, 18:06 WIB

CVE-2026-13719

Alert rules in restricted folders disclosed via the alert rules list API

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T11:06:38.172Z. Updated 2026-09-30T14:29:13.891Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:29 WIB

Official record

MedPublished 30 Sep 2026, 18:00 WIB

CVE-2026-96342

WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T11:00:18.127Z. Updated 2026-09-30T13:37:20.706Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

MedPublished 30 Sep 2026, 17:30 WIB

CVE-2026-103113

OS4ED openSIS-Classic General Information Tab Student.php save action sql injection

A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be performed from remote. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T10:30:08.940Z. Updated 2026-10-01T15:26:08.502Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:26 WIB

Official record

HighPublished 30 Sep 2026, 17:16 WIB

CVE-2026-103239

MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T10:16:18.835Z. Updated 2026-09-30T16:50:57.400Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:50 WIB

Official record

HighPublished 30 Sep 2026, 16:56 WIB

CVE-2026-103237

MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit), the application sanitizes the f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:56:35.584Z. Updated 2026-09-30T17:08:51.346Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:08 WIB

Official record

CritPublished 30 Sep 2026, 16:47 WIB

CVE-2026-77185

Apache MINA SSHD: Asynchronous authentication can bypass signature verification

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform "asynchronous authentic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:47:03.852Z. Updated 2026-09-30T16:52:13.274Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:52 WIB

Official record

HighPublished 30 Sep 2026, 16:45 WIB

CVE-2026-93994

Apache MINA SSHD: Repeated-publickey policy bypass on server

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD prov…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:45:32.561Z. Updated 2026-09-30T14:29:38.124Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:29 WIB

Official record

CritPublished 30 Sep 2026, 16:43 WIB

CVE-2026-94053

Apache MINA SSHD: LDAP injection in sshd-ldap

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:43:47.477Z. Updated 2026-09-30T14:30:10.327Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:30 WIB

Official record

HighPublished 30 Sep 2026, 16:43 WIB

CVE-2026-10764

Information disclosure in BVMS 4.5 up to 12.3

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:43:45.287Z. Updated 2026-09-30T14:30:34.058Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:30 WIB

Official record

MedPublished 30 Sep 2026, 16:38 WIB

CVE-2026-93995

Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:38:47.654Z. Updated 2026-09-30T14:30:58.296Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:30 WIB

Official record

MedPublished 30 Sep 2026, 16:37 WIB

CVE-2026-93996

Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:37:42.595Z. Updated 2026-09-30T14:31:21.957Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:31 WIB

Official record

HighPublished 30 Sep 2026, 16:37 WIB

CVE-2026-94002

Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client implementation,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:37:01.922Z. Updated 2026-09-30T14:31:45.869Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:31 WIB

Official record

MedPublished 30 Sep 2026, 16:35 WIB

CVE-2026-94029

Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" (for instance 256, which is the minimum…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:35:51.711Z. Updated 2026-09-30T19:42:56.102Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:42 WIB

Official record

CritPublished 30 Sep 2026, 16:34 WIB

CVE-2026-94052

Apache MINA SSHD: LDAP password authentication ineffective

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:34:43.917Z. Updated 2026-09-30T14:32:12.688Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:32 WIB

Official record

HighPublished 30 Sep 2026, 16:23 WIB

CVE-2026-79625

Improper Synchronization in Monitoring in CODESYS Control Runtime

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause inco…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:23:16.775Z. Updated 2026-09-30T13:49:14.992Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:49 WIB

Official record

HighPublished 30 Sep 2026, 16:09 WIB

CVE-2026-103235

MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the pri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T09:09:36.761Z. Updated 2026-09-30T14:32:45.581Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:32 WIB

Official record