Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 41–60 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

MedPublished 31 May 2026, 10:15 WIB

CVE-2026-10166

Edimax BR-6478AC POST Request formWlbasic command injection

A vulnerability was determined in Edimax BR-6478AC 1.23. The affected element is the function formWlbasic of the file /goform/formWlbasic of the component POST Request Handler. This manipulation of the argument rootAPmac causes command injection. The attack is possible to be carried out remotely. The exploit has been p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T03:15:08.139Z. Updated 2026-06-01T15:06:21.344Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:06 WIB

Official record

HighPublished 31 May 2026, 10:00 WIB

CVE-2026-10165

Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow

A vulnerability was identified in Edimax BR-6478AC 1.23. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. Such manipulation of the argument pppUserName leads to stack-based buffer overflow. The attack may be performed from remote. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 41 to 60 of 6933.First page Next page

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T03:00:10.931Z. Updated 2026-06-01T13:28:00.283Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 20:28 WIB

Official record

HighPublished 31 May 2026, 09:30 WIB

CVE-2026-10164

Edimax BR-6478AC POST Request formUSBFolder buffer overflow

A vulnerability was found in Edimax BR-6478AC 1.23. Impacted is the function formUSBFolder of the file /goform/formUSBFolder of the component POST Request Handler. The manipulation of the argument ShareName/SelectName results in buffer overflow. The attack can be executed remotely. The exploit has been made public and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T02:30:08.775Z. Updated 2026-06-02T02:19:37.543Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Jun 2026, 09:19 WIB

Official record

MedPublished 31 May 2026, 09:28 WIB

CVE-2026-8382

Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters

The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the post_title and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T02:28:00.276Z. Updated 2026-06-01T10:33:23.161Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 17:33 WIB

Official record

HighPublished 31 May 2026, 09:15 WIB

CVE-2026-10163

Edimax BR-6478AC POST Request formUSBAccount buffer overflow

A vulnerability has been found in Edimax BR-6478AC 1.23. This issue affects the function formUSBAccount of the file /goform/formUSBAccount of the component POST Request Handler. The manipulation of the argument UserName/Password leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T02:15:08.626Z. Updated 2026-06-02T02:18:07.614Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Jun 2026, 09:18 WIB

Official record

HighPublished 31 May 2026, 09:00 WIB

CVE-2026-10162

TRENDnet TEW-432BRP formSetPassword stack-based overflow

A flaw has been found in TRENDnet TEW-432BRP 3.10B20. This vulnerability affects the function formSetPassword of the file /goform/formSetPassword. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T02:00:12.314Z. Updated 2026-06-01T14:35:42.911Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 21:35 WIB

Official record

HighPublished 31 May 2026, 08:45 WIB

CVE-2026-10161

TRENDnet TEW-432BRP formResetStatistic stack-based overflow

A vulnerability was detected in TRENDnet TEW-432BRP 3.10B20. This affects the function formResetStatistic of the file /goform/formResetStatistic. Performing a manipulation of the argument status_statistic results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T01:45:07.861Z. Updated 2026-06-01T15:24:53.198Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:24 WIB

Official record

HighPublished 31 May 2026, 08:30 WIB

CVE-2026-10160

TRENDnet TEW-432BRP formSetEnableWizard stack-based overflow

A security vulnerability has been detected in TRENDnet TEW-432BRP 3.10B20. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. Such manipulation of the argument start_wizard leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T01:30:09.425Z. Updated 2026-06-01T15:06:51.697Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:06 WIB

Official record

HighPublished 31 May 2026, 08:15 WIB

CVE-2026-10159

TRENDnet TEW-432BRP formSysLog stack-based overflow

A weakness has been identified in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSysLog of the file /goform/formSysLog. This manipulation of the argument current_page causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T01:15:08.867Z. Updated 2026-06-01T13:45:43.034Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 20:45 WIB

Official record

HighPublished 31 May 2026, 07:45 WIB

CVE-2026-10158

TRENDnet TEW-432BRP formPortFw stack-based overflow

A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. Affected is the function formPortFw of the file /goform/formPortFw. The manipulation of the argument server_name results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T00:45:08.477Z. Updated 2026-06-02T02:15:51.795Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Jun 2026, 09:15 WIB

Official record

MedPublished 31 May 2026, 07:30 WIB

CVE-2026-10157

Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication

A vulnerability was identified in Open5GS up to 2.7.6. This impacts an unknown function of the file src/amf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and mig…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T00:30:10.718Z. Updated 2026-10-21T09:02:58.337Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated21 Oct 2026, 16:02 WIB

Official record

MedPublished 31 May 2026, 06:45 WIB

CVE-2026-10156

Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption

A vulnerability was determined in Open5GS up to 2.7.7. This affects the function handle_amf_info in the library /lib/sbi/nnrf-handler.c of the component nf-instances Endpoint. Executing a manipulation of the argument nf_info_pool can lead to resource consumption. The attack may be performed from remote. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-30T23:45:09.307Z. Updated 2026-06-01T14:54:38.404Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 21:54 WIB

Official record

MedPublished 31 May 2026, 06:30 WIB

CVE-2026-10155

Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection

A vulnerability was found in Bdtask Multi-Store Inventory Management System 1.0. The impacted element is the function accounts_report_search of the file application/modules/accounts/controllers/Accounts.php of the component Accounts Report Handler. Performing a manipulation of the argument dtpToDate results in sql inje…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-30T23:30:09.916Z. Updated 2026-06-01T15:24:59.803Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:24 WIB

Official record

MedPublished 31 May 2026, 06:00 WIB

CVE-2026-10154

Dolibarr ERP CRM messaging.php authorization

A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. Upgrading to version 23.0.3 is sufficient to fix this issue…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-30T23:00:13.659Z. Updated 2026-06-01T15:07:52.012Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:07 WIB

Official record

MedPublished 31 May 2026, 04:00 WIB

CVE-2026-10153

westboy CicadasCMS AbstractCacheManager.java search cross site scripting

A flaw has been found in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Impacted is the function Search of the file org/springframework/cache/support/AbstractCacheManager.java. This manipulation of the argument s causes cross site scripting. Remote exploitation of the attack is possible. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-30T21:00:20.910Z. Updated 2026-06-01T13:46:49.313Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 20:46 WIB

Official record

MedPublished 31 May 2026, 02:15 WIB

CVE-2026-10152

TaleLin lin-cms-spring-boot book Endpoint BookController.java access control

A vulnerability was detected in TaleLin lin-cms-spring-boot up to 0.2.1. This issue affects some unknown processing of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation results in improper access controls. The attack may be launched remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-30T19:15:08.710Z. Updated 2026-06-03T18:19:52.983Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Jun 2026, 01:19 WIB

Official record

MedPublished 30 May 2026, 23:30 WIB

CVE-2026-10127

Edimax BR-6478AC POST Request formStaDrvSetup command injection

A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. This manipulation of the argument rootAPmac causes command injection. The attack may be initiated remotely. The exploit has been made available to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-30T16:30:08.799Z. Updated 2026-06-02T02:13:22.781Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2026, 09:13 WIB

Official record

HighPublished 30 May 2026, 23:15 WIB

CVE-2026-10126

Edimax BR-6478AC POST Request formQoS buffer overflow

A security flaw has been discovered in Edimax BR-6478AC 1.23. Affected by this issue is the function formQoS of the file /goform/formQoS of the component POST Request Handler. The manipulation of the argument selSSID results in buffer overflow. The attack can be launched remotely. The exploit has been released to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-30T16:15:07.823Z. Updated 2026-06-01T14:55:05.171Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 21:55 WIB

Official record

HighPublished 30 May 2026, 23:00 WIB

CVE-2026-10125

Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow

A vulnerability was identified in Edimax BR-6478AC 1.23. Affected by this vulnerability is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. The manipulation of the argument pppUserName leads to stack-based buffer overflow. The attack can be initiated remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-30T16:00:12.552Z. Updated 2026-06-01T15:25:07.859Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:25 WIB

Official record

HighPublished 30 May 2026, 22:45 WIB

CVE-2026-10124

Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow

A vulnerability was determined in Shibby Tomato up to 1.28. Affected is the function rip_zebra_read_ipv4 of the file /usr/sbin/ripd of the component Zserv Handler. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-30T15:45:17.819Z. Updated 2026-06-01T15:08:34.006Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:08 WIB

Official record