Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4281–4300 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 20 Aug 2026, 00:16 WIB

CVE-2025-14603

Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:16:08.456Z. Updated 2026-08-19T19:05:52.839Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:05 WIB

Official record

CritPublished 20 Aug 2026, 00:11 WIB

CVE-2026-71470

Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 4281 to 4300 of 12259.First page Next page

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:11:02.513Z. Updated 2026-09-05T14:24:18.067Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated05 Sep 2026, 21:24 WIB

Official record

HighPublished 20 Aug 2026, 00:02 WIB

CVE-2026-50173

Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has `ExecuteEvents`, even when that member lacks `ReadFiles` and `WriteFiles`. The ro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T17:02:15.667Z. Updated 2026-08-19T17:32:27.973Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 00:32 WIB

Official record

CritKEVPublished 19 Aug 2026, 23:56 WIB

CVE-2026-72530

CVE-2026-72530

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

Excerpt language: en.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2026-08-19T16:56:53.099Z. Updated 2026-08-21T03:55:18.512Z.

CVSS9v3.1KEVListedEPSSPresentUpdated21 Aug 2026, 10:55 WIB

Official record

CritKEVPublished 19 Aug 2026, 23:55 WIB

CVE-2026-72529

CVE-2026-72529

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2026-08-19T16:55:14.949Z. Updated 2026-08-21T03:55:16.895Z.

CVSS9.8v3.1KEVListedEPSSPresentUpdated21 Aug 2026, 10:55 WIB

Official record

HighPublished 19 Aug 2026, 23:40 WIB

CVE-2024-13942

Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privileges

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND, EMMC or SD). The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key, the public part …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:40:18.082Z. Updated 2026-08-19T19:10:15.374Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:10 WIB

Official record

HighPublished 19 Aug 2026, 23:39 WIB

CVE-2026-20320

CVE-2026-20320

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:39:04.920Z. Updated 2026-08-19T19:14:41.602Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:14 WIB

Official record

LowPublished 19 Aug 2026, 23:35 WIB

CVE-2026-75583

keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSRF guard validates a h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:35:53.999Z. Updated 2026-08-21T11:21:04.300Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated21 Aug 2026, 18:21 WIB

Official record

MedPublished 19 Aug 2026, 23:29 WIB

CVE-2026-75147

FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:29:03.399Z. Updated 2026-10-27T10:14:33.598Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

HighPublished 19 Aug 2026, 23:28 WIB

CVE-2026-75146

FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:28:19.356Z. Updated 2026-10-27T10:14:32.933Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

MedPublished 19 Aug 2026, 23:27 WIB

CVE-2026-75145

FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:27:33.120Z. Updated 2026-10-27T10:14:32.244Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

HighPublished 19 Aug 2026, 23:26 WIB

CVE-2026-75144

FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:26:53.987Z. Updated 2026-10-27T10:14:31.556Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

CritPublished 19 Aug 2026, 23:26 WIB

CVE-2026-75143

FFmpeg Heap Buffer Overflow via RIST Protocol Reader

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reacha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:26:12.445Z. Updated 2026-10-27T10:14:30.888Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

HighPublished 19 Aug 2026, 23:24 WIB

CVE-2026-75142

FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:24:57.738Z. Updated 2026-10-27T10:14:30.175Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

HighPublished 19 Aug 2026, 23:24 WIB

CVE-2026-75141

FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during mux…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:24:01.813Z. Updated 2026-10-27T10:14:29.483Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

MedPublished 19 Aug 2026, 23:22 WIB

CVE-2026-49392

Wazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems, FIMDBCreator::encodeString() d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:22:49.021Z. Updated 2026-08-19T17:44:32.200Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 00:44 WIB

Official record

MedPublished 19 Aug 2026, 23:22 WIB

CVE-2026-20327

Cisco Unified Intelligence Center SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:22:04.420Z. Updated 2026-10-20T18:23:51.177Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 01:23 WIB

Official record

MedPublished 19 Aug 2026, 23:21 WIB

CVE-2026-44256

Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. api/api/aloggin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:21:49.920Z. Updated 2026-08-19T18:18:11.834Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:18 WIB

Official record

HighPublished 19 Aug 2026, 23:20 WIB

CVE-2026-45798

Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/shared/version_op.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy() but does not explicitly terminate the b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:20:54.636Z. Updated 2026-08-19T17:20:26.591Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 00:20 WIB

Official record

MedPublished 19 Aug 2026, 23:20 WIB

CVE-2026-20314

Cisco Packaged Contact Center Enterprise & Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability

A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T16:20:34.434Z. Updated 2026-08-19T19:33:48.763Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:33 WIB

Official record