Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4241–4260 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 20 Aug 2026, 01:17 WIB

CVE-2026-55483

Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created accou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T18:17:11.372Z. Updated 2026-08-25T03:38:32.673Z.

CVSS4.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 10:38 WIB

Official record

CritPublished 20 Aug 2026, 01:16 WIB

CVE-2026-70496

Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 4241 to 4260 of 12259.First page Next page

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T18:16:13.386Z. Updated 2026-09-05T14:24:07.335Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated05 Sep 2026, 21:24 WIB

Official record

MedPublished 20 Aug 2026, 01:15 WIB

CVE-2026-50550

Snipe-IT: 2FA reset privilege bypass

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing tw…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T18:15:44.305Z. Updated 2026-08-19T18:31:49.186Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:31 WIB

Official record

MedPublished 20 Aug 2026, 01:13 WIB

CVE-2026-49870

Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successful guess creates a full…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T18:13:05.368Z. Updated 2026-08-21T21:49:16.895Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:49 WIB

Official record

MedPublished 20 Aug 2026, 01:11 WIB

CVE-2026-49976

Snipe-IT: User Account Escalation via CSV Import

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting usern…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T18:11:48.501Z. Updated 2026-08-19T19:18:33.675Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:18 WIB

Official record

HighPublished 20 Aug 2026, 01:02 WIB

CVE-2026-19234

Power System Buffer Overflow

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T18:02:11.071Z. Updated 2026-08-21T03:57:09.120Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 10:57 WIB

Official record

HighPublished 20 Aug 2026, 01:00 WIB

CVE-2026-63633

FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_F…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T18:00:52.230Z. Updated 2026-08-27T16:24:59.145Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

HighPublished 20 Aug 2026, 00:59 WIB

CVE-2026-63652

FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An authenticated RDP client can trigger an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:59:07.480Z. Updated 2026-08-19T18:13:15.780Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:13 WIB

Official record

MedPublished 20 Aug 2026, 00:55 WIB

CVE-2026-63117

FreeRDP: Denial of service through ADPCM frame size calculation

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs` calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_fr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:55:39.015Z. Updated 2026-08-19T18:46:58.088Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:46 WIB

Official record

MedPublished 20 Aug 2026, 00:52 WIB

CVE-2026-18874

Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:52:39.317Z. Updated 2026-09-08T21:23:22.566Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated09 Sep 2026, 04:23 WIB

Official record

HighPublished 20 Aug 2026, 00:51 WIB

CVE-2026-55192

FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:51:19.479Z. Updated 2026-08-25T03:36:30.059Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 10:36 WIB

Official record

HighPublished 20 Aug 2026, 00:50 WIB

CVE-2026-55194

FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:50:30.158Z. Updated 2026-08-27T16:25:00.719Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:25 WIB

Official record

MedPublished 20 Aug 2026, 00:48 WIB

CVE-2026-55648

FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds Check

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dime…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:48:51.223Z. Updated 2026-08-21T21:49:23.791Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:49 WIB

Official record

HighPublished 20 Aug 2026, 00:48 WIB

CVE-2026-75149

marimo < 0.23.15 Code Injection via MCP Server Configuration

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mode, marimo launches the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:48:46.525Z. Updated 2026-08-21T19:41:11.333Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:41 WIB

Official record

HighPublished 20 Aug 2026, 00:46 WIB

CVE-2026-55193

FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:46:39.233Z. Updated 2026-08-27T16:25:00.881Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:25 WIB

Official record

HighPublished 20 Aug 2026, 00:45 WIB

CVE-2026-61518

ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not block quote-free boolean…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:45:48.946Z. Updated 2026-08-20T15:21:50.616Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:21 WIB

Official record

MedPublished 20 Aug 2026, 00:45 WIB

CVE-2026-55564

FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:45:47.438Z. Updated 2026-08-25T03:33:53.901Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 10:33 WIB

Official record

MedPublished 20 Aug 2026, 00:45 WIB

CVE-2026-19653

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper handling of memory page table configurations.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:45:10.142Z. Updated 2026-08-21T16:15:40.150Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:15 WIB

Official record

HighPublished 20 Aug 2026, 00:44 WIB

CVE-2026-55191

FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:44:52.392Z. Updated 2026-08-19T18:17:07.147Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:17 WIB

Official record

HighPublished 20 Aug 2026, 00:42 WIB

CVE-2026-62680

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:42:11.227Z. Updated 2026-08-19T18:06:47.948Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:06 WIB

Official record