Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,616 published records · 20 KEV · 4,616 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,616 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3317.2%
High1,42031%
Med1,98843%
Low2104.5%
None360.78%
Legacy00.00%
Unscored63114%

Matching records by UTC month

Feb 264,616

Signal coverage

KEV-listed: 20
With a forecast: 4,616
Unknown date: 0
Unscored severity: 631

Share of cohort: KEV 0.43% · forecast 100% · unscored 14%.

Showing 421–440 of 4,616By severity band: Critical · 9.0–10.0 331, High · 7.0–8.9 1,420, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 210, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 631

HighPublished 26 Feb 2026, 03:05 WIB

CVE-2026-0752

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI.

Excerpt language: en.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T20:05:19.818Z. Updated 2026-02-26T14:44:05.136Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 21:44 WIB

Official record

HighPublished 26 Feb 2026, 03:05 WIB

CVE-2026-1388

Inefficient Regular Expression Complexity in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint under certain conditions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 421 to 440 of 4616.First page Next page

Published 2026-02-25T20:05:05.289Z. Updated 2026-02-26T15:07:56.004Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:07 WIB

Official record

HighPublished 26 Feb 2026, 03:04 WIB

CVE-2026-1662

Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T20:04:59.913Z. Updated 2026-02-26T15:10:46.924Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:10 WIB

Official record

MedPublished 26 Feb 2026, 03:04 WIB

CVE-2026-1747

Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packages.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T20:04:49.893Z. Updated 2026-02-26T15:39:03.951Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:39 WIB

Official record

MedPublished 26 Feb 2026, 03:04 WIB

CVE-2026-1725

Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed an unauthenticated user to cause denial of service by sending specially crafted requests to a CI jobs API endpoint.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T20:04:44.830Z. Updated 2026-02-26T15:42:29.688Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:42 WIB

Official record

MedPublished 26 Feb 2026, 03:04 WIB

CVE-2026-2845

Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an authenticated user to cause denial of service by exploiting a Bitbucket Server import endpoint via repeatedly sending large responses.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T20:04:35.210Z. Updated 2026-02-26T15:45:14.406Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:45 WIB

Official record

MedPublished 26 Feb 2026, 03:02 WIB

CVE-2026-3200

z-9527 admin user.js getUsers sql injection

A vulnerability was identified in z-9527 admin 1.0/2.0. The affected element is the function checkName/register/login/getUser/getUsers of the file /server/controller/user.js. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor wa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T20:02:08.548Z. Updated 2026-02-27T17:57:56.330Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:57 WIB

Official record

MedPublished 26 Feb 2026, 03:01 WIB

CVE-2026-25942

FreeRDP has global-buffer-overflow in xf_rail_server_execute_result

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0–6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server send…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T20:01:16.472Z. Updated 2026-02-26T20:47:09.779Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:47 WIB

Official record

MedPublished 26 Feb 2026, 03:00 WIB

CVE-2026-22721

VMware Aria Operations privilege escalation vulnerability

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fixed Version' column of t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T20:00:15.719Z. Updated 2026-02-27T04:55:47.793Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 11:55 WIB

Official record

MedPublished 26 Feb 2026, 02:55 WIB

CVE-2026-25941

FreeRDP: vuln_1_15_1 RDPGFX WIRE_TO_SURFACE_2 Out-of-Bounds Read

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted W…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T19:55:24.984Z. Updated 2026-02-26T21:33:42.006Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 04:33 WIB

Official record

MedPublished 26 Feb 2026, 02:50 WIB

CVE-2026-25736

Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom RSE Attribute of the WebUI where attacker-controlled i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T19:50:52.820Z. Updated 2026-02-26T15:59:19.879Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 22:59 WIB

Official record

MedPublished 26 Feb 2026, 02:43 WIB

CVE-2026-25735

Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Identity Name of the WebUI where attacker-controlled input is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T19:43:36.463Z. Updated 2026-02-26T16:00:36.501Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:00 WIB

Official record

MedPublished 26 Feb 2026, 02:33 WIB

CVE-2025-3525

Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have, under certain circumstances, allowed an authenticated user with certain access to cause Denial of Service by creating specially crafted CI triggers via the API.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T19:33:56.609Z. Updated 2026-02-25T20:51:14.590Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 03:51 WIB

Official record

MedPublished 26 Feb 2026, 02:33 WIB

CVE-2026-25734

Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the RSE metadata of the WebUI where attacker-controlled input is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T19:33:44.627Z. Updated 2026-02-26T16:01:36.671Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:01 WIB

Official record

MedPublished 26 Feb 2026, 02:33 WIB

CVE-2025-14103

Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthorized user with Developer-role permissions to set pipeline variables for manually triggered jobs under certain conditions.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T19:33:35.698Z. Updated 2026-02-25T20:52:22.958Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 03:52 WIB

Official record

HighPublished 26 Feb 2026, 02:33 WIB

CVE-2026-22720

VMware Aria Operations stored cross-site scripting vulnerability

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T19:33:14.729Z. Updated 2026-04-14T10:40:29.059Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 17:40 WIB

Official record

HighPublished 26 Feb 2026, 02:30 WIB

CVE-2026-25733

Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom Rules function of the WebUI where attacker-controlled …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T19:30:55.695Z. Updated 2026-02-26T16:02:31.146Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:02 WIB

Official record

MedPublished 26 Feb 2026, 02:28 WIB

CVE-2026-25138

Rucio WebUI has Username Enumeration via Login Error Message

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T19:28:35.628Z. Updated 2026-02-26T16:03:22.817Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:03 WIB

Official record

HighKEVPublished 26 Feb 2026, 02:18 WIB

CVE-2026-22719

VMware Aria Operations command injection vulnerability

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2026-02-25T19:18:59.269Z. Updated 2026-04-14T10:38:25.169Z.

CVSS8.1v3.1KEVListedEPSSPresentUpdated14 Apr 2026, 17:38 WIB

Official record

HighPublished 26 Feb 2026, 01:57 WIB

CVE-2026-25136

Rucio WebUI has a Reflected Cross-site Scripting Vulnerability

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessage of the WebUI 500 err…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:57:28.589Z. Updated 2026-02-26T20:44:57.174Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:44 WIB

Official record