Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 421–440 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 29 Mar 2026, 20:15 WIB

CVE-2026-5045

Tenda FH1201 Parameter WrlclientSet stack-based overflow

A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/WrlclientSet of the component Parameter Handler. Performing a manipulation of the argument GO results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T13:15:12.383Z. Updated 2026-04-01T15:35:12.209Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 22:35 WIB

Official record

UnscoredPublished 29 Mar 2026, 19:55 WIB

CVE-2026-23400

rust_binder: call set_notification_done() without proc lock

In the Linux kernel, the following vulnerability has been resolved: rust_binder: call set_notification_done() without proc lock Consider the following sequence of events on a death listener: 1. The remote process dies and sends a BR_DEAD_BINDER message. 2. The local process invokes the BC_CLEAR_DEATH_NOTIFICATION com…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 421 to 440 of 6236.First page Next page

Published 2026-03-29T12:55:50.660Z. Updated 2026-05-11T22:06:10.668Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:06 WIB

Official record

HighPublished 29 Mar 2026, 19:44 WIB

CVE-2026-33575

OpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reuse the shared gateway credential outside the intended one-tim…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:32.407Z. Updated 2026-06-23T16:15:35.070Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

MedPublished 29 Mar 2026, 19:44 WIB

CVE-2026-33574

OpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download

OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archive download and copy operations. A local attacker can rebind the tools-root path between validation and final write to redirect the installer …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:31.816Z. Updated 2026-06-23T16:15:34.377Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 29 Mar 2026, 19:44 WIB

CVE-2026-33573

OpenClaw < 2026.3.11 - Workspace Boundary Bypass via Agent RPC Parameters

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled spawnedBy and workspaceDir values. Remote operators can escape the configured workspace b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:31.060Z. Updated 2026-06-23T16:15:33.708Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

MedPublished 29 Mar 2026, 19:44 WIB

CVE-2026-33572

OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript Files

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:30.369Z. Updated 2026-06-23T16:15:32.989Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

CritPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32987

OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including privilege escalation to operator.admin.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:29.705Z. Updated 2026-06-23T16:15:31.627Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32980

OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing wo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:28.919Z. Updated 2026-06-23T16:15:30.242Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32979

OpenClaw < 2026.3.11 - Unbound Interpreter and Runtime Commands Bypass in node-host Approval

OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local code by modifying scripts between approval and execution when exact file binding cannot occur. Remote attackers can change approved local scripts before execution to achieve unintended code execution as …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:28.226Z. Updated 2026-06-23T16:15:29.556Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32978

OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved ru…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:27.571Z. Updated 2026-06-23T16:15:28.855Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

MedPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32975

OpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups to bypass channel authorization and route messages from unintended groups …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:26.875Z. Updated 2026-06-23T16:15:26.768Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32974

OpenClaw < 2026.3.12 - Forged Event Injection via Feishu Webhook Verification Token

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forged Feishu events and trigger downstream tool execution by reaching the web…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:26.283Z. Updated 2026-06-23T16:15:26.056Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32973

OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard matching across path segments to execute commands or paths not intended by o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:25.567Z. Updated 2026-06-23T16:15:25.363Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32972

OpenClaw < 2026.3.11 - Authorization Bypass in Browser Profile Management via browser.request

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile management routes through browser.request. Attackers can create or modify browser profiles and persist attacker-controlled remote CDP endpoin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:24.909Z. Updated 2026-06-23T16:15:24.689Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

MedPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32924

OpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in Feishu

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass groupAllowFrom and requireMention protections in group chat reaction-derived …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:24.268Z. Updated 2026-06-23T16:15:22.661Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

MedPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32923

OpenClaw < 2026.3.11 - Authorization Bypass in Discord Guild Reaction Allowlist Enforcement

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reaction ingestion that fails to enforce member users and roles allowlist checks. Non-allowlisted guild members can trigger reaction events accepted as trusted system events, injecting reaction text into downstream session context…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:23.669Z. Updated 2026-06-23T16:15:21.988Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

CritPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32922

OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current scope set. Attackers can obtain operator.admin tokens for paired devices a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:22.872Z. Updated 2026-06-23T16:15:21.315Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

MedPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32919

OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash Commands

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with operator.write scope can issue agent requests containing /new or /reset slash commands to reset targeted conversation state without holding operator.admin privil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:22.118Z. Updated 2026-06-23T16:15:19.271Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32918

OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:21.433Z. Updated 2026-06-23T16:15:18.557Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

HighPublished 29 Mar 2026, 19:44 WIB

CVE-2026-32915

OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Subagent Control Surface

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf worker can steer or kill sibling runs and cause execution with broader t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-29T12:44:20.732Z. Updated 2026-06-23T16:15:16.475Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record