Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 19 KEV · 15,829 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 19
With a forecast: 15,829
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 98% · unscored 22%.

Showing 421–440 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 29 Oct 2026, 05:33 WIB

CVE-2026-55561

InvoicePlane: Guest user IDOR in quote approval and rejection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` and `reject()` methods in the Guest Quotes controller, `application/modules/guest/…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T22:33:47.140Z. Updated 2026-10-28T22:33:47.140Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 05:33 WIB

Official record

MedPublished 29 Oct 2026, 05:30 WIB

CVE-2026-75520

Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate acce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 421 to 440 of 16156.First page Next page

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T22:30:59.693Z. Updated 2026-10-28T22:30:59.693Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 05:30 WIB

Official record

MedPublished 29 Oct 2026, 05:15 WIB

CVE-2026-118577

maotoumao MusicFreeDesktop Request Forwarder server-side request forgery

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T22:15:17.877Z. Updated 2026-10-29T15:52:21.877Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:52 WIB

Official record

MedPublished 29 Oct 2026, 05:00 WIB

CVE-2026-118538

a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T22:00:18.460Z. Updated 2026-10-28T22:00:18.460Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 05:00 WIB

Official record

MedPublished 29 Oct 2026, 04:57 WIB

CVE-2026-61575

AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_queue.title` without neutralization. `fileURI` is not in the `objects/security.php` filter lists, and the `Login::canUpload()` capability needed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:57:55.205Z. Updated 2026-10-28T21:57:55.205Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:57 WIB

Official record

HighPublished 29 Oct 2026, 04:54 WIB

CVE-2026-61569

AVideo-Encoder: pre-authentication streamer-login SQL injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get` in `objects/Streamer.php`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:54:38.358Z. Updated 2026-10-29T15:11:35.842Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:11 WIB

Official record

HighPublished 29 Oct 2026, 04:53 WIB

CVE-2026-54453

OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in `SettingsUI` (`manageProfessional`) accepts administrator-controlled license key input that is reconstructed into a PHP `define()` s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:53:24.736Z. Updated 2026-10-28T21:53:24.736Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:53 WIB

Official record

HighPublished 29 Oct 2026, 04:49 WIB

CVE-2026-61571

AVideo-Encoder: missing authentication on control and status endpoints

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder::run()`. `view/queue.json.php` calls `Encoder::getAll(true)`, reveals streamer URLs…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:49:16.840Z. Updated 2026-10-28T21:49:16.840Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:49 WIB

Official record

HighPublished 29 Oct 2026, 04:48 WIB

CVE-2026-116641

The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:48:52.581Z. Updated 2026-10-29T15:13:15.811Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:13 WIB

Official record

HighPublished 29 Oct 2026, 04:47 WIB

CVE-2026-61572

AVideo-Encoder: unauthenticated full-response server-side request forgery

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts caller-controlled destinations after only `FILTER_VALIDATE_URL` syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer verification. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:47:39.328Z. Updated 2026-10-29T15:14:17.879Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:14 WIB

Official record

MedPublished 29 Oct 2026, 04:46 WIB

CVE-2026-61573

AVideo-Encoder: reflected cross-site scripting in the login interface

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In `view/index.php`, `webSiteRootURL` is returned verbatim by `Streamer::getStreamerURL()` in `objects/Streamer.php` and reaches navigation and form attributes; it …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:46:18.413Z. Updated 2026-10-28T21:46:18.413Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:46 WIB

Official record

MedPublished 29 Oct 2026, 04:45 WIB

CVE-2026-118537

a2ui Image Player/Video Player/Audio Player Image.js input validation

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:45:16.400Z. Updated 2026-10-28T21:45:16.400Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:45 WIB

Official record

HighPublished 29 Oct 2026, 04:45 WIB

CVE-2026-54455

OpenCATS: Authenticated SQL injection in activity DataGrid date filters

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in `home:CallsDataGrid` and `activity:ActivityDataGrid` uses request-controlled `period`, `startDate` and `endDate` parameters without sufficient val…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:45:00.241Z. Updated 2026-10-28T21:45:00.241Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:45 WIB

Official record

CritPublished 29 Oct 2026, 04:43 WIB

CVE-2026-61567

AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:43:48.515Z. Updated 2026-10-28T21:43:48.515Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:43 WIB

Official record

CritPublished 29 Oct 2026, 04:42 WIB

CVE-2026-61564

AVideo-Encoder: unauthenticated installer PHP code injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:42:42.397Z. Updated 2026-10-28T21:42:42.397Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:42 WIB

Official record

MedPublished 29 Oct 2026, 04:41 WIB

CVE-2026-57448

Blombooru: administrator image-proxy server-side request forgery

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `/api/booru-import/proxy-image`, accepts a `url` query parameter and fetches it server-side without meaningful destination validation. `proxy_im…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:41:21.557Z. Updated 2026-10-28T21:41:21.557Z.

CVSS6.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:41 WIB

Official record

HighPublished 29 Oct 2026, 04:41 WIB

CVE-2026-93851

Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:41:15.727Z. Updated 2026-10-29T15:15:32.984Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:15 WIB

Official record

HighPublished 29 Oct 2026, 04:40 WIB

CVE-2026-61546

AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools

AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuritySettings` with `enable_dns_rebinding_protection=False`, in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:40:16.081Z. Updated 2026-10-28T21:40:16.081Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:40 WIB

Official record

HighPublished 29 Oct 2026, 04:18 WIB

CVE-2026-118804

Bricks Broken Access Control via query_result Endpoint

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:18:28.475Z. Updated 2026-10-28T21:18:28.475Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:18 WIB

Official record

HighPublished 29 Oct 2026, 04:11 WIB

CVE-2026-118803

Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T21:11:32.437Z. Updated 2026-10-28T21:11:32.437Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:11 WIB

Official record