Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 541–560 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 28 Apr 2026, 06:24 WIB

CVE-2026-41364

OpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar Upload

OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers can exploit this by uploading tar archives containing symlinks to escape the sandbox and overwrite files on the remote host.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T23:24:27.866Z. Updated 2026-04-29T14:05:55.863Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 21:05 WIB

Official record

MedPublished 28 Apr 2026, 06:24 WIB

CVE-2026-41363

OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter

OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution during upload_image operations to read arbitrary files outside configured localRoots boun…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 541 to 560 of 5813.First page Next page

Published 2026-04-27T23:24:26.962Z. Updated 2026-05-25T23:42:15.106Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 06:42 WIB

Official record

LowPublished 28 Apr 2026, 06:24 WIB

CVE-2026-41362

OpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication

OpenClaw versions 2026.2.19 before 2026.3.31 contain an improper cache isolation vulnerability in the Zalo webhook replay-dedupe mechanism that is shared across authenticated webhook targets. Attackers controlling one authenticated Zalo webhook path in multi-account deployments can suppress legitimate events on differe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T23:24:26.193Z. Updated 2026-05-26T11:52:14.165Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 18:52 WIB

Official record

HighPublished 28 Apr 2026, 06:15 WIB

CVE-2026-40972

CVE-2026-40972

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote applica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T23:15:19.194Z. Updated 2026-04-29T03:55:44.263Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 10:55 WIB

Official record

MedPublished 28 Apr 2026, 06:15 WIB

CVE-2026-7199

SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_product. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T23:15:13.647Z. Updated 2026-04-28T14:48:37.412Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 21:48 WIB

Official record

MedPublished 28 Apr 2026, 06:00 WIB

CVE-2026-7196

CodeAstro Online Classroom guestdetails sql injection

A security vulnerability has been detected in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /guestdetails. Such manipulation of the argument deleteid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T23:00:20.080Z. Updated 2026-04-28T14:35:24.217Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 21:35 WIB

Official record

MedPublished 28 Apr 2026, 05:45 WIB

CVE-2026-40971

CVE-2026-40971

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.

Excerpt language: en.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T22:45:13.327Z. Updated 2026-04-28T12:46:29.029Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 19:46 WIB

Official record

MedPublished 28 Apr 2026, 05:45 WIB

CVE-2026-7194

SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection

A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_product. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T22:45:12.170Z. Updated 2026-04-28T12:48:06.769Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 19:48 WIB

Official record

HighPublished 28 Apr 2026, 05:44 WIB

CVE-2026-28747

Milesight Cameras Authorization Bypass Through User-Controlled Key

A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T22:44:52.012Z. Updated 2026-04-28T14:35:33.191Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 21:35 WIB

Official record

MedPublished 28 Apr 2026, 05:30 WIB

CVE-2026-7183

aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception

A vulnerability has been found in aligungr UERANSIM up to 3.2.7. The affected element is the function rls::DecodeRlsMessage in the library src/lib/rls/rls_pdu.cpp of the component Radio Link Simulation Layer. The manipulation of the argument pduLength leads to uncaught exception. The attack may be initiated remotely. U…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T22:30:15.208Z. Updated 2026-04-28T15:15:00.680Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 22:15 WIB

Official record

MedPublished 28 Apr 2026, 05:15 WIB

CVE-2026-7179

OSPG binwalk WinCE Extraction Plugin winceextract.py read_null_terminated_string path traversal

A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Such manipulation of the argument self.file_name leads to path traversal. The attack can o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T22:15:15.535Z. Updated 2026-04-29T14:04:08.019Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 21:04 WIB

Official record

MedPublished 28 Apr 2026, 05:00 WIB

CVE-2026-7178

ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery

A weakness has been identified in ChatGPTNextWeb NextChat up to 2.16.1. This affects the function storeUrl of the file app/api/artifacts/route.ts of the component Artifacts Endpoint. This manipulation of the argument ID causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T22:00:20.342Z. Updated 2026-04-28T14:01:44.043Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 21:01 WIB

Official record

MedPublished 28 Apr 2026, 04:45 WIB

CVE-2026-7177

ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery

A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1. Affected by this issue is the function proxyHandler of the file app/api/[provider]/[...path]/route.ts. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the publi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T21:45:15.349Z. Updated 2026-04-28T14:47:57.952Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 21:47 WIB

Official record

HighPublished 28 Apr 2026, 04:30 WIB

CVE-2026-7160

Tenda HG3 formTracert command injection

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T21:30:17.351Z. Updated 2026-04-28T14:35:44.664Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 21:35 WIB

Official record

MedPublished 28 Apr 2026, 04:15 WIB

CVE-2026-7159

douinc mkdocs-mcp-plugin server.py list_documents path traversal

A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function read_document/list_documents of the file server.py. Performing a manipulation of the argument docs_dir/file_path results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T21:15:14.082Z. Updated 2026-04-28T12:49:01.319Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 19:49 WIB

Official record

MedPublished 28 Apr 2026, 04:00 WIB

CVE-2026-7158

dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery

A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function _validate_url_safe of the file src/mcp_url_downloader/server.py. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T21:00:17.311Z. Updated 2026-04-28T15:00:55.140Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 22:00 WIB

Official record

MedPublished 28 Apr 2026, 03:46 WIB

CVE-2026-3087

shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T20:46:43.201Z. Updated 2026-08-13T00:28:13.615Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated13 Aug 2026, 07:28 WIB

Official record

MedPublished 28 Apr 2026, 03:45 WIB

CVE-2026-7157

disler aider-mcp-server aider_ai_code server.py command injection

A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknown functionality of the file src/aider_mcp_server/server.py of the component aider_ai_code. This manipulation of the argument relative_editable_files causes command injection. Remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T20:45:13.983Z. Updated 2026-04-29T14:01:20.148Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 21:01 WIB

Official record

CritPublished 28 Apr 2026, 03:30 WIB

CVE-2026-7156

Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T20:30:20.851Z. Updated 2026-04-28T14:10:58.745Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 21:10 WIB

Official record

MedPublished 28 Apr 2026, 03:16 WIB

CVE-2026-5362

Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering

An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-27T20:16:01.154Z. Updated 2026-04-28T14:36:06.112Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 21:36 WIB

Official record