Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4081–4100 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

CritPublished 20 Aug 2026, 04:00 WIB

CVE-2026-76584

TRENDnet TV-IP751WIC alphapd set_time.cgi stack-based overflow

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be launched remotely. The explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:00:09.812Z. Updated 2026-08-20T14:03:40.620Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 21:03 WIB

Official record

HighPublished 20 Aug 2026, 03:58 WIB

CVE-2026-62727

Windows Telephony Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 4081 to 4100 of 12259.First page Next page

Published 2026-08-19T20:58:27.911Z. Updated 2026-10-28T20:08:41.781Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:08 WIB

Official record

HighPublished 20 Aug 2026, 03:56 WIB

CVE-2026-75596

Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslC…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:56:21.657Z. Updated 2026-08-20T19:59:14.152Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:59 WIB

Official record

MedPublished 20 Aug 2026, 03:56 WIB

CVE-2026-76827

Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the callin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:56:17.608Z. Updated 2026-09-05T17:08:45.208Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated06 Sep 2026, 00:08 WIB

Official record

HighPublished 20 Aug 2026, 03:51 WIB

CVE-2026-69222

LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.join(sep). The concat filter can cheaply double arrays of referenc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:51:44.218Z. Updated 2026-08-21T21:47:58.206Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:47 WIB

Official record

HighPublished 20 Aug 2026, 03:49 WIB

CVE-2026-61556

LiquidJS: An infinite loop vulnerability in `strip_html` filter

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:49:56.020Z. Updated 2026-08-25T14:16:38.259Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:16 WIB

Official record

HighPublished 20 Aug 2026, 03:48 WIB

CVE-2026-54491

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every redirect target. Ph…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:48:12.951Z. Updated 2026-08-20T19:47:26.429Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:47 WIB

Official record

HighPublished 20 Aug 2026, 03:47 WIB

CVE-2026-76139

Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:47:50.883Z. Updated 2026-10-16T15:31:14.729Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 22:31 WIB

Official record

HighPublished 20 Aug 2026, 03:47 WIB

CVE-2026-75569

Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:47:45.877Z. Updated 2026-09-29T19:41:48.297Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:41 WIB

Official record

HighPublished 20 Aug 2026, 03:46 WIB

CVE-2026-54493

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/C…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:46:50.890Z. Updated 2026-08-21T18:13:02.201Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 01:13 WIB

Official record

MedPublished 20 Aug 2026, 03:46 WIB

CVE-2026-54494

Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authentica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:46:01.824Z. Updated 2026-08-25T14:14:08.109Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:14 WIB

Official record

MedPublished 20 Aug 2026, 03:45 WIB

CVE-2026-76583

TRENDnet TV-IP751WIC alphapd set_time.cgi command injection

A vulnerability was identified in TRENDnet TV-IP751WIC 11.03.03. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:45:08.998Z. Updated 2026-08-20T18:21:38.293Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:21 WIB

Official record

MedPublished 20 Aug 2026, 03:44 WIB

CVE-2026-54492

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:44:33.090Z. Updated 2026-08-20T13:43:02.603Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 20:43 WIB

Official record

HighPublished 20 Aug 2026, 03:44 WIB

CVE-2026-75616

Command Injection in Router Web Management Interface

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device comprom…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:44:11.468Z. Updated 2026-08-20T15:26:33.291Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:26 WIB

Official record

MedPublished 20 Aug 2026, 03:43 WIB

CVE-2026-68555

coturn: Chained mobility resumes allow authenticated remote memory exhaustion

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:43:11.038Z. Updated 2026-08-21T18:14:20.511Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 01:14 WIB

Official record

MedPublished 20 Aug 2026, 03:39 WIB

CVE-2026-68552

Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16_t len variable in stun_get_message_len_str() in src/client/ns_turn_msg.c to wrap when STUN_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:39:14.822Z. Updated 2026-08-21T21:48:07.059Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:48 WIB

Official record

LowPublished 20 Aug 2026, 03:38 WIB

CVE-2026-68554

Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:38:28.419Z. Updated 2026-08-20T13:36:14.992Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 20:36 WIB

Official record

HighPublished 20 Aug 2026, 03:37 WIB

CVE-2026-68553

Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is_secure_string() validation and is embedded into Redis keys at nine call sites in src/apps/relay/ns_ioalib_eng…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:37:42.319Z. Updated 2026-08-20T19:48:45.809Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 02:48 WIB

Official record

MedPublished 20 Aug 2026, 03:37 WIB

CVE-2026-12634

Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with buf[rc] = '\0', where rc is the return value of nvs_read(). Per its contract, nvs_read() returns the full stored entry length (wlk_ate.len…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:37:36.742Z. Updated 2026-08-20T15:26:33.463Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:26 WIB

Official record

HighPublished 20 Aug 2026, 03:37 WIB

CVE-2026-12522

Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields

The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c parses the PDP-context dynamic parameters (local address, subnet mask, gateway, and DNS servers) that the cellular network assigns to the device. The response is linearized into a 256-by…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T20:37:35.638Z. Updated 2026-08-20T15:26:33.628Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:26 WIB

Official record