Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4181–4200 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 20 Aug 2026, 02:31 WIB

CVE-2026-16661

Power System Integer Overflow

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:31:30.150Z. Updated 2026-08-22T03:55:52.286Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:55 WIB

Official record

CritPublished 20 Aug 2026, 02:31 WIB

CVE-2026-16840

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:31:14.221Z. Updated 2026-08-22T03:55:53.457Z.

Showing 4181 to 4200 of 12259.First page Next page

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 10:55 WIB

Official record

CritPublished 20 Aug 2026, 02:30 WIB

CVE-2026-16839

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:30:58.688Z. Updated 2026-08-20T12:31:40.524Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 19:31 WIB

Official record

HighPublished 20 Aug 2026, 02:30 WIB

CVE-2026-16838

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use (TOCTOU) race condition.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:30:41.375Z. Updated 2026-08-26T14:16:52.090Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:16 WIB

Official record

HighPublished 20 Aug 2026, 02:30 WIB

CVE-2026-16837

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:30:23.947Z. Updated 2026-08-20T15:26:33.933Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:26 WIB

Official record

MedPublished 20 Aug 2026, 02:30 WIB

CVE-2026-55088

Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although the record includes createdAt, the transfer has no expiratio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:30:20.288Z. Updated 2026-08-21T21:48:47.361Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:48 WIB

Official record

MedPublished 20 Aug 2026, 02:30 WIB

CVE-2026-76572

pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:30:10.341Z. Updated 2026-08-20T12:30:55.812Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 19:30 WIB

Official record

HighPublished 20 Aug 2026, 02:30 WIB

CVE-2026-16836

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:30:03.771Z. Updated 2026-08-20T15:26:34.089Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:26 WIB

Official record

CritPublished 20 Aug 2026, 02:29 WIB

CVE-2026-16834

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:29:43.406Z. Updated 2026-08-20T15:21:30.312Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:21 WIB

Official record

MedPublished 20 Aug 2026, 02:29 WIB

CVE-2026-55087

Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control: private, no-store. A …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:29:16.221Z. Updated 2026-08-21T21:48:54.703Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:48 WIB

Official record

MedPublished 20 Aug 2026, 02:29 WIB

CVE-2026-16833

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to disclose kernel memory due to an out-of-bounds read.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:29:15.023Z. Updated 2026-08-20T15:26:34.243Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:26 WIB

Official record

HighPublished 20 Aug 2026, 02:28 WIB

CVE-2026-16831

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:28:58.579Z. Updated 2026-08-20T15:26:34.395Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:26 WIB

Official record

UnscoredPublished 20 Aug 2026, 02:28 WIB

CVE-2026-19508

RDK WebUI heap-based buffer overflow vulnerability

Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:28:29.196Z. Updated 2026-08-27T17:19:56.917Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:19 WIB

Official record

MedPublished 20 Aug 2026, 02:28 WIB

CVE-2026-16829

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:28:18.585Z. Updated 2026-08-20T15:21:35.974Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:21 WIB

Official record

UnscoredPublished 20 Aug 2026, 02:28 WIB

CVE-2026-19509

RDK WebUI DOS vulnerability

Improper input validation in `ajaxSet_wireless_network_configuration.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows an authenticated attacker to cause denial of service via a crafted `ssid_number` parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:28:14.342Z. Updated 2026-08-27T15:31:36.658Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:31 WIB

Official record

UnscoredPublished 20 Aug 2026, 02:28 WIB

CVE-2026-19507

RDK WebUI uncontrolled resource consumption

Uncontrolled resource consumption in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause denial of service via excessively large password values.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:28:05.161Z. Updated 2026-08-27T15:39:20.176Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:39 WIB

Official record

MedPublished 20 Aug 2026, 02:27 WIB

CVE-2026-68901

WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service

Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from the attacker-controlle…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:27:58.094Z. Updated 2026-08-19T19:40:09.254Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:40 WIB

Official record

MedPublished 20 Aug 2026, 02:27 WIB

CVE-2026-16827

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:27:57.150Z. Updated 2026-08-19T19:38:58.990Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:38 WIB

Official record

UnscoredPublished 20 Aug 2026, 02:27 WIB

CVE-2026-19506

RDK-B WebUI race condition vulnerability

Race condition in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:27:55.948Z. Updated 2026-08-27T15:47:36.279Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:47 WIB

Official record

UnscoredPublished 20 Aug 2026, 02:27 WIB

CVE-2026-19505

RDK-B WebUI improper cryptographic signature verification vulnerability

Improper cryptographic signature verification in `jst_functions.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T19:27:40.654Z. Updated 2026-08-27T16:10:08.424Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:10 WIB

Official record