Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 19 KEV · 15,829 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 19
With a forecast: 15,829
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 98% · unscored 22%.

Showing 481–500 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 29 Oct 2026, 02:25 WIB

CVE-2026-118650

Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resol…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:25:02.952Z. Updated 2026-10-28T19:25:02.952Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:25 WIB

Official record

MedPublished 29 Oct 2026, 02:21 WIB

CVE-2026-118266

Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the overr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 481 to 500 of 16156.First page Next page

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:21:47.729Z. Updated 2026-10-28T19:21:47.729Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:21 WIB

Official record

HighPublished 29 Oct 2026, 02:21 WIB

CVE-2026-78674

Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:21:38.203Z. Updated 2026-10-29T02:02:13.846Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:02 WIB

Official record

HighPublished 29 Oct 2026, 02:21 WIB

CVE-2026-6647

Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing mixed-case characters d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:21:35.702Z. Updated 2026-10-29T02:02:13.994Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:02 WIB

Official record

LowPublished 29 Oct 2026, 02:21 WIB

CVE-2026-3583

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:21:34.577Z. Updated 2026-10-29T02:02:14.134Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:02 WIB

Official record

MedPublished 29 Oct 2026, 02:21 WIB

CVE-2026-11854

Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perfor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:21:33.216Z. Updated 2026-10-29T02:02:14.279Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:02 WIB

Official record

HighPublished 29 Oct 2026, 02:21 WIB

CVE-2025-14260

Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:21:32.066Z. Updated 2026-10-29T02:02:14.426Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:02 WIB

Official record

HighPublished 29 Oct 2026, 02:17 WIB

CVE-2026-109411

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:17:45.459Z. Updated 2026-10-28T19:17:45.459Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:17 WIB

Official record

MedPublished 29 Oct 2026, 02:03 WIB

CVE-2026-118265

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:03:56.934Z. Updated 2026-10-28T19:03:56.934Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:03 WIB

Official record

CritPublished 29 Oct 2026, 02:03 WIB

CVE-2026-118264

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:03:01.533Z. Updated 2026-10-28T19:03:01.533Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:03 WIB

Official record

MedPublished 29 Oct 2026, 02:01 WIB

CVE-2026-118263

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:01:30.268Z. Updated 2026-10-28T19:01:30.268Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:01 WIB

Official record

HighPublished 29 Oct 2026, 02:00 WIB

CVE-2026-118262

Echo: WebSocket proxy can retain connections and handlers after client disconnect

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connecti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:00:12.315Z. Updated 2026-10-28T19:00:12.315Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:00 WIB

Official record

HighPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118688

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to move host directories in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:56.965Z. Updated 2026-10-28T18:59:56.965Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

HighPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118687

Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:56.265Z. Updated 2026-10-28T18:59:56.265Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

HighPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118686

EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:55.556Z. Updated 2026-10-28T18:59:55.556Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118685

ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard

ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an acc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:54.863Z. Updated 2026-10-28T18:59:54.863Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

HighPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118684

MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:54.186Z. Updated 2026-10-28T18:59:54.186Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

HighPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118683

MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to logging.config.fileConfig that eval()s handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Python at workflow con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:53.203Z. Updated 2026-10-28T18:59:53.203Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118681

go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:52.523Z. Updated 2026-10-28T18:59:52.523Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118680

SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:51.831Z. Updated 2026-10-28T18:59:51.831Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record