Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,616 published records · 20 KEV · 4,616 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,616 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3317.2%
High1,42031%
Med1,98843%
Low2104.5%
None360.78%
Legacy00.00%
Unscored63114%

Matching records by UTC month

Feb 264,616

Signal coverage

KEV-listed: 20
With a forecast: 4,616
Unknown date: 0
Unscored severity: 631

Share of cohort: KEV 0.43% · forecast 100% · unscored 14%.

Showing 41–60 of 4,616By severity band: Critical · 9.0–10.0 331, High · 7.0–8.9 1,420, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 210, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 631

HighPublished 28 Feb 2026, 04:08 WIB

CVE-2026-28402

nimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verification

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.2.2, a malicious or compromised validator that is elected as proposer can publish a macro block proposal where `header.body_root` does not match the actual macro body hash…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:08:53.573Z. Updated 2026-03-03T20:31:59.946Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:31 WIB

Official record

HighPublished 28 Feb 2026, 04:06 WIB

CVE-2026-28400

Docker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpoint

Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST `/engines/_configure` endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server (llama.cpp). By injecting …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 41 to 60 of 4616.First page Next page

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:06:12.418Z. Updated 2026-03-03T20:30:39.966Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:30 WIB

Official record

LowPublished 28 Feb 2026, 04:04 WIB

CVE-2026-28355

"PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scripting

Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can insert Javascript into the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:04:13.445Z. Updated 2026-03-03T20:29:43.254Z.

CVSS1.3v4.0KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:29 WIB

Official record

MedPublished 28 Feb 2026, 04:01 WIB

CVE-2026-28352

Indico missing access check in event series management API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:01:45.740Z. Updated 2026-03-03T20:29:18.718Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:29 WIB

Official record

MedPublished 28 Feb 2026, 03:59 WIB

CVE-2026-28351

Manipulated RunLengthDecode streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:59:16.839Z. Updated 2026-03-03T20:28:45.592Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:28 WIB

Official record

MedPublished 28 Feb 2026, 03:28 WIB

CVE-2026-28338

PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:28:05.739Z. Updated 2026-03-03T20:26:01.369Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:26 WIB

Official record

MedPublished 28 Feb 2026, 03:25 WIB

CVE-2026-28288

Dify has a user enumeration issue

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:25:24.599Z. Updated 2026-02-27T20:45:44.126Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 03:45 WIB

Official record

HighPublished 28 Feb 2026, 03:22 WIB

CVE-2026-28272

Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 conta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:22:59.656Z. Updated 2026-03-03T20:27:59.264Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:27 WIB

Official record

MedPublished 28 Feb 2026, 03:21 WIB

CVE-2026-28271

Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:21:12.194Z. Updated 2026-03-03T20:27:38.925Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:27 WIB

Official record

MedPublished 28 Feb 2026, 03:19 WIB

CVE-2026-28270

Kiteworks Core has an Unrestricted Upload of File with Dangerous Type

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:19:54.611Z. Updated 2026-03-03T20:27:18.932Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:27 WIB

Official record

CritPublished 28 Feb 2026, 03:16 WIB

CVE-2026-28268

Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:16:29.842Z. Updated 2026-03-03T20:26:53.644Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:26 WIB

Official record

UnscoredPublished 28 Feb 2026, 03:15 WIB

CVE-2018-25160

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:15:31.418Z. Updated 2026-03-03T20:22:20.829Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:22 WIB

Official record

MedPublished 28 Feb 2026, 03:13 WIB

CVE-2026-28231

pillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Read

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:13:45.195Z. Updated 2026-03-03T20:25:30.145Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:25 WIB

Official record

UnscoredPublished 28 Feb 2026, 03:12 WIB

CVE-2026-3255

HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function

HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guess…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:12:35.414Z. Updated 2026-03-03T20:23:53.160Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:23 WIB

Official record

HighPublished 28 Feb 2026, 02:54 WIB

CVE-2026-27836

phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even wh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T19:54:51.992Z. Updated 2026-03-03T20:25:01.562Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:25 WIB

Official record

CritPublished 28 Feb 2026, 02:52 WIB

CVE-2026-27947

Group-Office Vulnerable to Remote Code Execution (RCE)

Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T19:52:41.592Z. Updated 2026-03-03T20:24:32.730Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:24 WIB

Official record

HighPublished 28 Feb 2026, 02:49 WIB

CVE-2026-27832

Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator

Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the `advancedQueryData` parameter (`comparator` field) on an authenticated endpoint. The endpoint `index.php?r=email/template/e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T19:49:57.867Z. Updated 2026-03-02T12:56:47.385Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated02 Mar 2026, 19:56 WIB

Official record

MedPublished 28 Feb 2026, 02:46 WIB

CVE-2026-27824

calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and the `X-Forwarded-For` header. Since the `X-Forwarded-For` header is read directly …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T19:46:07.612Z. Updated 2026-03-02T12:54:32.182Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated02 Mar 2026, 19:54 WIB

Official record

MedPublished 28 Feb 2026, 02:44 WIB

CVE-2026-27810

calibre Vulnerable to HTTP Response Header Injection

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection vulnerability in the calibre Content Server allows any authenticated user to inject arbitrary HTTP headers into server responses via an unsanitized `content_disp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T19:44:39.106Z. Updated 2026-03-02T12:53:36.368Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated02 Mar 2026, 19:53 WIB

Official record

MedPublished 28 Feb 2026, 02:41 WIB

CVE-2026-27734

Beszel Vulnerable to Docker API Path Traversal via Unsanitized Container ID

Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Docker Engine API URLs using fmt.Sprintf wit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T19:41:30.418Z. Updated 2026-03-02T12:52:19.071Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated02 Mar 2026, 19:52 WIB

Official record