Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 9,759 published records · 23 KEV · 9,759 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

9,759 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit9269.5%
High3,57237%
Med2,95330%
Low3183.3%
None120.12%
Legacy00.00%
Unscored1,97820%

Matching records by UTC month

Jul 269,759

Signal coverage

KEV-listed: 23
With a forecast: 9,759
Unknown date: 0
Unscored severity: 1,978

Share of cohort: KEV 0.24% · forecast 100% · unscored 20%.

Showing 41–60 of 9,759By severity band: Critical · 9.0–10.0 926, High · 7.0–8.9 3,572, Medium · 4.0–6.9 2,953, Low · 0.1–3.9 318, None · scored 0.0 12, Legacy · v2 only 0, Unscored · no CNA metric 1,978

HighPublished 01 Aug 2026, 00:03 WIB

CVE-2026-55100

hashi-vault-js has a path traversal and query parameter injection

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path tr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:03:41.858Z. Updated 2026-07-31T19:57:01.760Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:57 WIB

Official record

HighPublished 31 Jul 2026, 23:58 WIB

CVE-2026-54729

dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. This iss…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 41 to 60 of 9759.First page Next page

Published 2026-07-31T16:58:56.571Z. Updated 2026-07-31T17:31:00.320Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 00:31 WIB

Official record

CritPublished 31 Jul 2026, 23:35 WIB

CVE-2026-58048

CVE-2026-58048

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:35:56.665Z. Updated 2026-08-07T18:00:28.533Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated08 Aug 2026, 01:00 WIB

Official record

MedPublished 31 Jul 2026, 23:35 WIB

CVE-2026-58047

CVE-2026-58047

HTTP Smuggling in cPanel allows potential leak of credentials.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:35:56.600Z. Updated 2026-08-07T18:00:48.776Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated08 Aug 2026, 01:00 WIB

Official record

MedPublished 31 Jul 2026, 23:30 WIB

CVE-2026-54706

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file()…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:30:58.062Z. Updated 2026-07-31T19:00:44.128Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:00 WIB

Official record

MedPublished 31 Jul 2026, 23:28 WIB

CVE-2026-54707

OnionShare Receive mode writes uploaded files even when file uploads are disabled

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:28:06.628Z. Updated 2026-07-31T23:28:15.094Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 06:28 WIB

Official record

HighPublished 31 Jul 2026, 23:20 WIB

CVE-2026-52856

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:20:31.222Z. Updated 2026-07-31T18:57:35.513Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:57 WIB

Official record

CritPublished 31 Jul 2026, 23:16 WIB

CVE-2026-52855

Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuratio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:16:42.470Z. Updated 2026-07-31T19:55:37.770Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:55 WIB

Official record

MedPublished 31 Jul 2026, 23:09 WIB

CVE-2026-52857

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is fixed in version 1.13.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:09:42.791Z. Updated 2026-07-31T16:16:47.071Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2026, 23:16 WIB

Official record

MedPublished 31 Jul 2026, 23:00 WIB

CVE-2026-59232

Stored Cross-site Scripting in Prospero Flow CRM lead name field

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:00:45.422Z. Updated 2026-07-31T16:57:56.183Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Jul 2026, 23:57 WIB

Official record

CritPublished 31 Jul 2026, 23:00 WIB

CVE-2026-17566

pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, ga…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:00:22.738Z. Updated 2026-08-01T03:56:13.838Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 10:56 WIB

Official record

CritPublished 31 Jul 2026, 23:00 WIB

CVE-2026-17351

pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing can disagree with Pos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:00:19.103Z. Updated 2026-08-01T03:56:14.973Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 10:56 WIB

Official record

MedPublished 31 Jul 2026, 23:00 WIB

CVE-2026-17350

pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator (permissions_required) was applied only to a sin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:00:03.744Z. Updated 2026-07-31T17:05:44.535Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 00:05 WIB

Official record

CritPublished 31 Jul 2026, 22:59 WIB

CVE-2026-17349

pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T15:59:47.841Z. Updated 2026-08-01T03:56:26.176Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 10:56 WIB

Official record

MedPublished 31 Jul 2026, 22:59 WIB

CVE-2026-17348

pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the sa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T15:59:18.714Z. Updated 2026-07-31T17:23:08.497Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 00:23 WIB

Official record

HighPublished 31 Jul 2026, 22:59 WIB

CVE-2026-17347

pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the command string and execu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T15:59:16.588Z. Updated 2026-08-01T03:56:12.755Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 10:56 WIB

Official record

HighPublished 31 Jul 2026, 22:59 WIB

CVE-2026-17346

pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in test_sql_string_literal_lint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and subscription names so…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T15:59:13.136Z. Updated 2026-08-01T03:56:11.625Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 10:56 WIB

Official record

HighPublished 31 Jul 2026, 22:59 WIB

CVE-2026-67607

LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state without holding t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T15:59:10.564Z. Updated 2026-08-14T16:50:59.309Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:50 WIB

Official record

MedPublished 31 Jul 2026, 22:49 WIB

CVE-2026-10686

Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6_route_packet() (subsys/net/ip) were affected: the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()). Each set the packet forwarding…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T15:49:10.405Z. Updated 2026-10-15T22:10:20.506Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:10 WIB

Official record

HighPublished 31 Jul 2026, 22:34 WIB

CVE-2026-18141

Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T15:34:16.724Z. Updated 2026-08-04T21:42:24.939Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 04:42 WIB

Official record