Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 401–420 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 30 Aug 2026, 21:33 WIB

CVE-2026-82644

WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent

WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal) that silently discards writes for any client identified as a bot by i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T14:33:28.331Z. Updated 2026-09-01T14:04:40.653Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:04 WIB

Official record

MedPublished 30 Aug 2026, 21:33 WIB

CVE-2026-82643

WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustained password guessing att…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 401 to 420 of 12259.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T14:33:27.655Z. Updated 2026-09-02T16:03:24.334Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 23:03 WIB

Official record

MedPublished 30 Aug 2026, 21:30 WIB

CVE-2026-82545

itsourcecode Sales and Inventory System sup_searchfrm.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/sup_searchfrm.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T14:30:09.315Z. Updated 2026-08-31T17:59:38.216Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:59 WIB

Official record

MedPublished 30 Aug 2026, 20:45 WIB

CVE-2026-82544

wger-project wger Password Reset gym.py reset_user_password cross-site request forgery

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This patch is called 3c6ce4…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T13:45:09.773Z. Updated 2026-08-31T22:04:31.087Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 05:04 WIB

Official record

HighPublished 30 Aug 2026, 20:44 WIB

CVE-2026-82642

Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T13:44:34.109Z. Updated 2026-08-31T16:45:59.286Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:45 WIB

Official record

HighPublished 30 Aug 2026, 20:23 WIB

CVE-2026-82641

Keploy 3.1.0-3.6.25 Unauthenticated TLS Key Exposure

Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T13:23:40.516Z. Updated 2026-09-02T18:13:51.319Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated03 Sep 2026, 01:13 WIB

Official record

MedPublished 30 Aug 2026, 20:23 WIB

CVE-2026-82640

browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T13:23:39.806Z. Updated 2026-09-24T14:20:35.710Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:20 WIB

Official record

HighPublished 30 Aug 2026, 20:23 WIB

CVE-2026-82639

NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T13:23:39.106Z. Updated 2026-09-24T14:20:34.749Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:20 WIB

Official record

HighPublished 30 Aug 2026, 20:23 WIB

CVE-2026-82638

jina-ai reader Server-Side Request Forgery via disabled private-address guard

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T13:23:38.400Z. Updated 2026-09-24T14:20:33.792Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:20 WIB

Official record

MedPublished 30 Aug 2026, 20:23 WIB

CVE-2026-82637

browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T13:23:37.621Z. Updated 2026-09-24T14:20:32.853Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:20 WIB

Official record

HighPublished 30 Aug 2026, 20:05 WIB

CVE-2026-82636

CVE-2026-82636

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.

Excerpt language: en.

Severity high: primary CNA CVSS 7.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T13:05:46.409Z. Updated 2026-08-31T16:47:43.793Z.

CVSS7.9v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:47 WIB

Official record

MedPublished 30 Aug 2026, 19:45 WIB

CVE-2026-82543

vastsa FileCodeBox Pickup Limit views.py update_file_usage race condition

A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage of the file apps/base/views.py of the component Pickup Limit Handler. Performing a manipulation results in race condition. It is possible to initiate the attack remotely. The exploit is now public and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T12:45:11.353Z. Updated 2026-08-31T16:48:35.331Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:48 WIB

Official record

HighPublished 30 Aug 2026, 19:34 WIB

CVE-2026-82634

Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint

Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T12:34:52.482Z. Updated 2026-10-27T10:14:37.666Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

MedPublished 30 Aug 2026, 19:34 WIB

CVE-2026-82633

Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity association…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T12:34:51.768Z. Updated 2026-08-31T18:52:40.704Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:52 WIB

Official record

CritPublished 30 Aug 2026, 19:30 WIB

CVE-2026-82542

Tenda HG10 Boa Web Server formIPv6Routing buffer overflow

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T12:30:09.679Z. Updated 2026-09-01T14:02:01.116Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:02 WIB

Official record

HighPublished 30 Aug 2026, 19:26 WIB

CVE-2026-82635

Pake arbitrary file write via unsanitized download_file filename

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T12:26:16.770Z. Updated 2026-08-31T16:58:51.598Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:58 WIB

Official record

MedPublished 30 Aug 2026, 19:01 WIB

CVE-2026-77454

exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit (or from_many?) and a parent(...)-referencing filter or sort. AshSql.Join.related_query/3 skips the caller-supplied exists predic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T12:01:23.862Z. Updated 2026-08-31T15:00:02.165Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:00 WIB

Official record

MedPublished 30 Aug 2026, 19:00 WIB

CVE-2026-82541

itsourcecode Sales and Inventory System sup_edit.php sql injection

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T12:00:09.633Z. Updated 2026-08-31T17:01:01.275Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:01 WIB

Official record

LowPublished 30 Aug 2026, 18:59 WIB

CVE-2026-81316

Same-named aggregates with differing filters are conflated in AshSql

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.different_queries?/2 reports two aggregate querie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T11:59:41.945Z. Updated 2026-08-31T14:59:22.223Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:59 WIB

Official record

LowPublished 30 Aug 2026, 18:56 WIB

CVE-2026-81318

Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.add_single_aggs/5 rebuilds the outer query from query.from.s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T11:56:52.921Z. Updated 2026-08-31T16:59:41.443Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:59 WIB

Official record