Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 5501–5520 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 02 Apr 2026, 21:01 WIB

CVE-2026-26927

URL (HTTP Origin) call location spoofing in Szafir SDK Web

Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched. In Szafir SDK Web it is possible to change the URL (HTTP Origin) of the application call location. An unauthenticated attacker can craft a website that is able to launch SzafirHost application with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T14:01:39.075Z. Updated 2026-04-02T14:19:19.180Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 21:19 WIB

Official record

HighPublished 02 Apr 2026, 21:01 WIB

CVE-2026-31931

Suricata tls: null dereference in tls.alpn rule keyword

Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with a NULL dereference. This issue has been patched in version 8.0.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 5501 to 5520 of 5813.First page Next page

Published 2026-04-02T14:01:03.512Z. Updated 2026-04-02T14:18:27.902Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 21:18 WIB

Official record

MedPublished 02 Apr 2026, 21:00 WIB

CVE-2026-5338

Tenda G103 Setting system.lua action_set_system_settings command injection

A security vulnerability has been detected in Tenda G103 1.0.0.5. The affected element is the function action_set_system_settings of the file system.lua of the component Setting Handler. Such manipulation of the argument lanIp leads to command injection. The attack may be performed from remote. The exploit has been dis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T14:00:18.555Z. Updated 2026-04-02T18:32:01.034Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:32 WIB

Official record

MedPublished 02 Apr 2026, 20:57 WIB

CVE-2026-30867

CocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet Parsing

CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash the host iOS/macOS/tvOS application. If an attacker publishes the 4-byte m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:57:06.394Z. Updated 2026-04-02T16:23:13.357Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 23:23 WIB

Official record

HighPublished 02 Apr 2026, 20:48 WIB

CVE-2026-35168

OpenSTAManager: SQL Injection via Aggiornamenti Module

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (Updates) module in OpenSTAManager contains a database conflict resolution feature (op=risolvi-conflitti-database) that accepts a JSON array of SQL statements via POST and executes the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:48:16.626Z. Updated 2026-04-02T16:23:20.657Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 23:23 WIB

Official record

MedPublished 02 Apr 2026, 20:45 WIB

CVE-2026-5334

itsourcecode Online Enrollment System Parameter index.php sql injection

A weakness has been identified in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.php?view=edit&id=3 of the component Parameter Handler. This manipulation of the argument deptid causes sql injection. The attack is possible to be carried out remotely. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:45:11.444Z. Updated 2026-04-02T16:23:27.536Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 23:23 WIB

Official record

HighPublished 02 Apr 2026, 20:44 WIB

CVE-2026-28805

OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAManager are vulnerable to Time-Based Blind SQL Injection through the options[stato] GET parameter. The user-supplied value is read from $superselect['stato'] and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:44:07.063Z. Updated 2026-04-02T18:31:08.958Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:31 WIB

Official record

HighPublished 02 Apr 2026, 20:42 WIB

CVE-2026-29782

OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table using the attacker-controlled GET parameter state, and during …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:42:25.134Z. Updated 2026-04-03T19:52:52.158Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated04 Apr 2026, 02:52 WIB

Official record

MedPublished 02 Apr 2026, 20:30 WIB

CVE-2026-5333

DefaultFuction Content-Management-System tools.php command injection

A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:30:14.585Z. Updated 2026-04-02T13:54:13.691Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:54 WIB

Official record

HighPublished 02 Apr 2026, 20:28 WIB

CVE-2026-2737

Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web application

A vulnerability exists in Progress Flowmon versions prior to 12.5.8 and 13.0.6, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:28:41.825Z. Updated 2026-04-03T03:55:29.158Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record

HighPublished 02 Apr 2026, 20:27 WIB

CVE-2026-3692

Unintended command execution during report generation in Progress Flowmon

In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:27:45.684Z. Updated 2026-04-03T03:55:27.668Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record

MedPublished 02 Apr 2026, 20:15 WIB

CVE-2026-5332

Xiaopi Panel WAF Firewall demo.php cross site scripting

A vulnerability was identified in Xiaopi Panel 1.0.0. This vulnerability affects unknown code of the file /demo.php of the component WAF Firewall. The manipulation of the argument param leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:15:11.183Z. Updated 2026-04-03T19:52:05.065Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated04 Apr 2026, 02:52 WIB

Official record

CritPublished 02 Apr 2026, 20:04 WIB

CVE-2026-2701

RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)

Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:04:38.554Z. Updated 2026-04-03T03:55:26.174Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record

CritPublished 02 Apr 2026, 20:04 WIB

CVE-2026-2699

EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)

Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:04:00.485Z. Updated 2026-04-08T15:25:21.185Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 22:25 WIB

Official record

MedPublished 02 Apr 2026, 20:00 WIB

CVE-2026-5331

OpenCart Extension Installer installer.php path traversal

A vulnerability was determined in OpenCart 4.1.0.3. This affects an unknown part of the file installer.php of the component Extension Installer Page. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was cont…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T13:00:13.393Z. Updated 2026-04-02T13:14:33.219Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:14 WIB

Official record

MedPublished 02 Apr 2026, 19:58 WIB

CVE-2026-34890

WordPress MSTW League Manager plugin <= 2.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O’Donnell MSTW League Manager allows DOM-Based XSS.This issue affects MSTW League Manager: from n/a through 2.10.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T12:58:01.605Z. Updated 2026-04-02T13:16:23.200Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:16 WIB

Official record

MedPublished 02 Apr 2026, 19:45 WIB

CVE-2026-5330

SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control

A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_user of the component User Delete Handler. Performing a manipulation of the argument ID results in improper access controls. The attack may be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T12:45:10.637Z. Updated 2026-04-02T14:19:51.165Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 21:19 WIB

Official record

HighPublished 02 Apr 2026, 19:45 WIB

CVE-2026-4636

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T12:45:01.841Z. Updated 2026-07-15T00:50:31.767Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 07:50 WIB

Official record

HighPublished 02 Apr 2026, 19:44 WIB

CVE-2026-4634

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Den…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T12:44:53.424Z. Updated 2026-10-06T16:58:54.945Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated06 Oct 2026, 23:58 WIB

Official record

MedPublished 02 Apr 2026, 19:44 WIB

CVE-2026-4325

Keycloak: keycloak: replay of action tokens via improper handling of single-use entries

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthoriz…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T12:44:52.997Z. Updated 2026-04-07T11:27:36.605Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 18:27 WIB

Official record