Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 401–420 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-30559

CVE-2026-30559

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_sales.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-04-06T13:45:25.078Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Apr 2026, 20:45 WIB

Official record

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-30560

CVE-2026-30560

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_supplier.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-04-06T13:45:42.570Z.

Showing 401 to 420 of 6236.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated06 Apr 2026, 20:45 WIB

Official record

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-30561

CVE-2026-30561

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_purchase.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-04-06T13:45:59.893Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Apr 2026, 20:45 WIB

Official record

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-30562

CVE-2026-30562

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_stock.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-03-30T18:13:15.980Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Mar 2026, 01:13 WIB

Official record

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-30563

CVE-2026-30563

A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the update_details.php file. The application fails to sanitize the "website" parameter provided in a POST request. This allows authenticated attackers to inject arbitrary web script…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-03-30T15:28:43.996Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:28 WIB

Official record

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-30564

CVE-2026-30564

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the view_payments.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-03-30T15:29:45.380Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:29 WIB

Official record

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-30565

CVE-2026-30565

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the view_supplier.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-03-30T15:30:34.724Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:30 WIB

Official record

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-30566

CVE-2026-30566

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the view_customers.php file via the "limit" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-03-30T15:31:22.779Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:31 WIB

Official record

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-33373

CVE-2026-33373

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after operations such as enabli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-04-01T15:38:23.209Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Apr 2026, 22:38 WIB

Official record

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-33643

CVE-2026-33643

SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the mysqlColumnAsInsert function in file plugins/mysql/lib/column.go.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-03-30T19:32:16.909Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Mar 2026, 02:32 WIB

Official record

UnscoredPublished 30 Mar 2026, 07:00 WIB

CVE-2026-34472

CVE-2026-34472

Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the default administrator password, WLAN PSK, and PPPoE credential…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-30T00:00:00.000Z. Updated 2026-05-26T05:20:49.814Z.

CVSS—KEVNot listedEPSSPresentUpdated26 May 2026, 12:20 WIB

Official record

HighPublished 30 Mar 2026, 06:33 WIB

CVE-2026-2370

Improper Handling of Parameters in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T23:33:44.410Z. Updated 2026-07-15T01:18:09.229Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:18 WIB

Official record

MedPublished 30 Mar 2026, 06:00 WIB

CVE-2026-5101

Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection

A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly ava…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T23:00:15.592Z. Updated 2026-03-30T14:52:01.775Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:52 WIB

Official record

UnscoredPublished 30 Mar 2026, 03:50 WIB

CVE-2026-4176

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has severa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T20:50:51.058Z. Updated 2026-03-30T15:35:08.162Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:35 WIB

Official record

HighPublished 30 Mar 2026, 02:35 WIB

CVE-2026-4946

NSA Ghidra Auto-Analysis Annotation Command Execution

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in commen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T19:35:30.692Z. Updated 2026-03-30T15:00:34.442Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:00 WIB

Official record

HighPublished 30 Mar 2026, 00:53 WIB

CVE-2026-0558

Unauthenticated File Upload in parisneo/lollms

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T17:53:08.003Z. Updated 2026-03-30T15:23:41.471Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:23 WIB

Official record

HighPublished 30 Mar 2026, 00:51 WIB

CVE-2026-0560

Server-Side Request Forgery (SSRF) in parisneo/lollms

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP request…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T17:51:20.708Z. Updated 2026-03-30T15:33:31.963Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:33 WIB

Official record

HighPublished 30 Mar 2026, 00:49 WIB

CVE-2026-0562

Insecure Direct Object Reference (IDOR) in parisneo/lollms

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not implement proper authorization checks, enabling Insecure Direct Object Reference…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T17:49:44.461Z. Updated 2026-04-22T14:57:21.275Z.

CVSS8.3v3.0KEVNot listedEPSSPresentUpdated22 Apr 2026, 21:57 WIB

Official record

HighPublished 30 Mar 2026, 00:02 WIB

CVE-2026-34005

CVE-2026-34005

In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T17:02:15.445Z. Updated 2026-03-30T14:19:23.210Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:19 WIB

Official record

HighPublished 29 Mar 2026, 21:15 WIB

CVE-2026-5046

Tenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflow

A flaw has been found in Tenda FH1201 1.2.0.14(408). Affected is the function formWrlExtraSet of the file /goform/WrlExtraSet of the component Parameter Handler. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T14:15:12.643Z. Updated 2026-03-30T14:10:52.945Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:10 WIB

Official record