Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 5401–5420 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 03 Apr 2026, 00:20 WIB

CVE-2026-34121

Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS

An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a reque…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:20:06.705Z. Updated 2026-04-02T17:58:52.376Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 00:58 WIB

Official record

HighPublished 03 Apr 2026, 00:19 WIB

CVE-2026-34120

Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of local video stream content due to insufficient alignment and validation of buffer boundaries when processing streaming inputs.An attacker on the same network segment could trigger heap memory corrupt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 5401 to 5420 of 5813.First page Next page

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:19:58.781Z. Updated 2026-04-02T17:58:08.441Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 00:58 WIB

Official record

HighPublished 03 Apr 2026, 00:19 WIB

CVE-2026-34119

Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when appending segmented request bodies without continuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input. An attacker on the same networ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:19:50.931Z. Updated 2026-04-03T13:06:40.136Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 20:06 WIB

Official record

HighPublished 03 Apr 2026, 00:19 WIB

CVE-2026-34118

Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C100, C101, C210 & C520WS

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5, C210 v3.6 and C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:19:43.453Z. Updated 2026-10-19T21:32:02.164Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated20 Oct 2026, 04:32 WIB

Official record

MedPublished 03 Apr 2026, 00:16 WIB

CVE-2026-34526

SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, in src/endpoints/search.js, the hostname is checked against /^\d+\.\d+\.\d+\.\d+$/. This only matches literal do…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:16:55.897Z. Updated 2026-04-02T17:48:03.787Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 00:48 WIB

Official record

HighPublished 03 Apr 2026, 00:15 WIB

CVE-2026-34524

SillyTavern: Path traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:15:22.819Z. Updated 2026-04-03T18:12:52.047Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated04 Apr 2026, 01:12 WIB

Official record

MedPublished 03 Apr 2026, 00:15 WIB

CVE-2026-5368

projectworlds Car Rental Project Parameter login.php sql injection

A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of the file /login.php of the component Parameter Handler. This manipulation of the argument uname causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:15:13.177Z. Updated 2026-04-02T17:44:32.432Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 00:44 WIB

Official record

MedPublished 03 Apr 2026, 00:14 WIB

CVE-2026-34523

SillyTavern: Path traversal allows file existence oracle

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in the static file route handler allows any unauthenticated user to determine whe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:14:31.694Z. Updated 2026-04-03T15:56:24.472Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 22:56 WIB

Official record

HighPublished 03 Apr 2026, 00:13 WIB

CVE-2026-34522

SillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlle…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:13:44.322Z. Updated 2026-04-02T19:00:48.579Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 02:00 WIB

Official record

MedPublished 03 Apr 2026, 00:10 WIB

CVE-2026-26962

Rack: Header injection in multipart requests

Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as filename or name instead of remov…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:10:17.091Z. Updated 2026-04-03T18:13:06.632Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated04 Apr 2026, 01:13 WIB

Official record

MedPublished 03 Apr 2026, 00:09 WIB

CVE-2026-34835

Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full par…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:09:07.047Z. Updated 2026-04-02T17:44:03.453Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 00:44 WIB

Official record

MedPublished 03 Apr 2026, 00:08 WIB

CVE-2026-35414

CVE-2026-35414

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:08:15.628Z. Updated 2026-04-02T18:17:04.391Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:17 WIB

Official record

HighPublished 03 Apr 2026, 00:07 WIB

CVE-2026-34827

Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated String#index searches combined with String#slice! prefix delet…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:07:48.279Z. Updated 2026-07-15T01:03:40.859Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:03 WIB

Official record

MedPublished 03 Apr 2026, 00:06 WIB

CVE-2026-32762

Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parses the RFC 7239 Forwarded header by splitting on semicolons before handling quoted-string values. Because quoted values may legally contain semicolons, a header can be inte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:06:50.819Z. Updated 2026-04-02T17:42:42.305Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 00:42 WIB

Official record

MedPublished 03 Apr 2026, 00:06 WIB

CVE-2026-33271

CVE-2026-33271

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 42902.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:06:24.089Z. Updated 2026-04-03T03:55:49.028Z.

CVSS6.7v3.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record

MedPublished 03 Apr 2026, 00:05 WIB

CVE-2026-27774

CVE-2026-27774

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:05:19.178Z. Updated 2026-04-03T03:55:47.929Z.

CVSS6.7v3.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record

MedPublished 03 Apr 2026, 00:04 WIB

CVE-2026-28728

CVE-2026-28728

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:04:45.425Z. Updated 2026-04-03T03:55:46.690Z.

CVSS6.7v3.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record

MedPublished 03 Apr 2026, 00:00 WIB

CVE-2026-5360

Free5GC aper type confusion

A vulnerability has been found in Free5GC 4.2.0. The affected element is an unknown function of the component aper. Such manipulation leads to type confusion. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclose…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T17:00:19.072Z. Updated 2026-04-03T19:59:25.061Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated04 Apr 2026, 02:59 WIB

Official record

LowPublished 02 Apr 2026, 23:57 WIB

CVE-2026-35388

CVE-2026-35388

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

Excerpt language: en.

Severity low: primary CNA CVSS 2.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T16:57:31.073Z. Updated 2026-04-02T18:16:41.820Z.

CVSS2.5v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:16 WIB

Official record

LowPublished 02 Apr 2026, 23:52 WIB

CVE-2026-35387

CVE-2026-35387

OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T16:52:53.623Z. Updated 2026-04-03T13:07:56.358Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 20:07 WIB

Official record