Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4261–4280 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

CritPublished 20 Aug 2026, 00:40 WIB

CVE-2026-62682

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:40:17.061Z. Updated 2026-08-19T18:19:27.462Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:19 WIB

Official record

CritPublished 20 Aug 2026, 00:39 WIB

CVE-2025-14600

Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account. Apply patch from vend…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 4261 to 4280 of 12259.First page Next page

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:39:42.792Z. Updated 2026-08-19T18:39:28.932Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:39 WIB

Official record

CritPublished 20 Aug 2026, 00:39 WIB

CVE-2026-72717

Orval: Import-time RCE via schema default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:39:23.125Z. Updated 2026-08-21T19:44:34.681Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:44 WIB

Official record

CritPublished 20 Aug 2026, 00:38 WIB

CVE-2026-71867

Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:38:36.371Z. Updated 2026-08-19T18:21:51.339Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:21 WIB

Official record

HighPublished 20 Aug 2026, 00:38 WIB

CVE-2026-19875

Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:38:06.110Z. Updated 2026-08-20T15:57:08.018Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:57 WIB

Official record

CritPublished 20 Aug 2026, 00:37 WIB

CVE-2026-71868

Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScrip…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:37:34.092Z. Updated 2026-08-21T19:43:39.471Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:43 WIB

Official record

CritPublished 20 Aug 2026, 00:36 WIB

CVE-2026-71865

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:36:47.668Z. Updated 2026-08-21T21:49:30.476Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:49 WIB

Official record

CritPublished 20 Aug 2026, 00:36 WIB

CVE-2026-71869

Orval: Import-time RCE via array-items default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled Jav…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:36:06.800Z. Updated 2026-08-25T03:32:48.556Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 10:32 WIB

Official record

CritPublished 20 Aug 2026, 00:34 WIB

CVE-2026-71864

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:34:55.340Z. Updated 2026-08-25T02:21:34.265Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 09:21 WIB

Official record

CritPublished 20 Aug 2026, 00:33 WIB

CVE-2026-71871

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlle…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:33:56.011Z. Updated 2026-08-21T21:49:37.465Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:49 WIB

Official record

CritPublished 20 Aug 2026, 00:33 WIB

CVE-2026-72716

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:33:01.745Z. Updated 2026-08-19T17:48:14.929Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 00:48 WIB

Official record

CritPublished 20 Aug 2026, 00:31 WIB

CVE-2026-62681

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controll…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:31:02.756Z. Updated 2026-08-21T19:42:09.266Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:42 WIB

Official record

CritPublished 20 Aug 2026, 00:30 WIB

CVE-2026-66794

Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:30:07.984Z. Updated 2026-09-29T19:41:11.722Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:41 WIB

Official record

HighPublished 20 Aug 2026, 00:30 WIB

CVE-2026-17183

CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data accessible through Grafana's configured datasource credentials …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:30:06.798Z. Updated 2026-08-27T17:22:31.524Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:22 WIB

Official record

CritPublished 20 Aug 2026, 00:27 WIB

CVE-2026-71866

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:27:28.222Z. Updated 2026-08-19T18:03:13.730Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:03 WIB

Official record

CritPublished 20 Aug 2026, 00:24 WIB

CVE-2026-32475

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.

Excerpt language: en.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:24:55.906Z. Updated 2026-08-20T18:28:10.957Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:28 WIB

Official record

HighPublished 20 Aug 2026, 00:20 WIB

CVE-2026-67581

On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount (ERC-20) or to and value (native). …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:20:09.606Z. Updated 2026-08-19T18:44:31.945Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:44 WIB

Official record

HighPublished 20 Aug 2026, 00:20 WIB

CVE-2026-73541

Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings (max_gas, max_fee_per_gas, max_p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:20:00.286Z. Updated 2026-08-19T18:47:04.542Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:47 WIB

Official record

HighPublished 20 Aug 2026, 00:19 WIB

CVE-2026-73136

Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an attribution nonce carri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:19:52.413Z. Updated 2026-08-19T18:54:00.153Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:54 WIB

Official record

MedPublished 20 Aug 2026, 00:19 WIB

CVE-2026-73829

Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race

Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mark sequence: check_ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:19:43.696Z. Updated 2026-08-19T18:58:33.322Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:58 WIB

Official record