Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 5521–5540 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 02 Apr 2026, 19:44 WIB

CVE-2026-4282

Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens, resulting in privilege esca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T12:44:52.941Z. Updated 2026-07-15T00:56:46.658Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 07:56 WIB

Official record

HighPublished 02 Apr 2026, 19:37 WIB

CVE-2026-3872

Keycloak: keycloak: information disclosure due to redirect_uri validation bypass

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 5521 to 5540 of 5813.First page Next page

Published 2026-04-02T12:37:30.633Z. Updated 2026-07-15T01:02:22.823Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:02 WIB

Official record

MedPublished 02 Apr 2026, 19:30 WIB

CVE-2026-5328

shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection

A weakness has been identified in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the function listItem of the file src/main/java/com/suisung/shopsuite/pt/service/impl/ProductIndexServiceImpl.java of the component ProductItemDao Interface. Executing a manipulation of the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T12:30:16.079Z. Updated 2026-04-02T13:31:24.614Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:31 WIB

Official record

MedPublished 02 Apr 2026, 18:45 WIB

CVE-2026-5327

efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection

A security flaw has been discovered in efforthye fast-filesystem-mcp up to 3.5.1. The affected element is the function handleGetDiskUsage of the file src/index.ts. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T11:45:11.124Z. Updated 2026-04-02T13:23:04.196Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:23 WIB

Official record

UnscoredPublished 02 Apr 2026, 18:40 WIB

CVE-2026-23417

bpf: Fix constant blinding for PROBE_MEM32 stores

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix constant blinding for PROBE_MEM32 stores BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to survive unblinded into JIT-compiled native code when bpf_jit_harden >= …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T11:40:57.837Z. Updated 2026-05-11T22:06:30.275Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:06 WIB

Official record

UnscoredPublished 02 Apr 2026, 18:40 WIB

CVE-2026-23416

mm/mseal: update VMA end correctly on merge

In the Linux kernel, the following vulnerability has been resolved: mm/mseal: update VMA end correctly on merge Previously we stored the end of the current VMA in curr_end, and then upon iterating to the next VMA updated curr_start to curr_end to advance to the next VMA. However, this doesn't take into account the f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T11:40:57.158Z. Updated 2026-05-11T22:06:29.099Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:06 WIB

Official record

HighPublished 02 Apr 2026, 18:40 WIB

CVE-2026-23415

futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()

In the Linux kernel, the following vulnerability has been resolved: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_replace_policy() which frees the old memp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T11:40:56.476Z. Updated 2026-10-19T18:35:43.155Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

HighPublished 02 Apr 2026, 18:40 WIB

CVE-2026-23414

tls: Purge async_hold in tls_decrypt_async_wait()

In the Linux kernel, the following vulnerability has been resolved: tls: Purge async_hold in tls_decrypt_async_wait() The async_hold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tls_decrypt_async_wait() returns, every AEAD operation has completed and the engine no long…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T11:40:55.746Z. Updated 2026-10-19T18:35:42.998Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

HighPublished 02 Apr 2026, 18:40 WIB

CVE-2026-23413

clsact: Fix use-after-free in init/destroy rollback asymmetry

In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry. The latter is achieved by first fully initializing a clsact instance, and then in a second step having a repl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T11:40:54.384Z. Updated 2026-10-19T18:35:42.855Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

HighPublished 02 Apr 2026, 18:40 WIB

CVE-2026-23412

netfilter: bpf: defer hook memory release until rcu readers are done

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: defer hook memory release until rcu readers are done Yiming Qian reports UaF when concurrent process is dumping hooks via nfnetlink_hooks: BUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0 Read of size 8 at ad…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T11:40:53.528Z. Updated 2026-10-19T18:35:42.715Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

MedPublished 02 Apr 2026, 17:45 WIB

CVE-2026-5326

SourceCodester Leave Application System User Information index.php authorization

A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the component User Information Handler. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is public…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T10:45:10.736Z. Updated 2026-04-03T19:51:06.681Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Apr 2026, 02:51 WIB

Official record

HighPublished 02 Apr 2026, 17:30 WIB

CVE-2026-32145

Multipart form body parser bypasses body size limits in wisp

Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing. The multipart_body function bypasses configured max_body_size and max_files_size limits. When a multipart boundary is not present in a chunk, the parser takes the MoreRequir…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T10:30:47.485Z. Updated 2026-04-07T04:07:10.339Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 11:07 WIB

Official record

MedPublished 02 Apr 2026, 16:45 WIB

CVE-2026-5246

Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization

A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this nature are highly complex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T09:45:11.602Z. Updated 2026-04-02T13:07:02.788Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:07 WIB

Official record

MedPublished 02 Apr 2026, 16:00 WIB

CVE-2026-5245

Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of comple…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T09:00:19.688Z. Updated 2026-04-02T14:27:27.092Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 21:27 WIB

Official record

MedPublished 02 Apr 2026, 16:00 WIB

CVE-2026-33617

MB connect line mbCONNECT24 vulnerable to an unauthenticated information disclosure in the data24 Endpoint

An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T09:00:10.713Z. Updated 2026-04-03T17:21:51.783Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated04 Apr 2026, 00:21 WIB

Official record

HighPublished 02 Apr 2026, 15:59 WIB

CVE-2026-33616

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint

An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T08:59:55.743Z. Updated 2026-04-02T13:08:18.951Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:08 WIB

Official record

CritPublished 02 Apr 2026, 15:59 WIB

CVE-2026-33615

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T08:59:48.843Z. Updated 2026-04-02T14:29:46.546Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 21:29 WIB

Official record

HighPublished 02 Apr 2026, 15:59 WIB

CVE-2026-33614

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T08:59:40.736Z. Updated 2026-04-02T13:30:10.029Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:30 WIB

Official record

HighPublished 02 Apr 2026, 15:59 WIB

CVE-2026-33613

MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray

Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T08:59:34.008Z. Updated 2026-04-02T13:42:38.209Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:42 WIB

Official record

MedPublished 02 Apr 2026, 15:53 WIB

CVE-2026-29136

CA Notification HTML Injection

SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to inject HTML into notification emails about new CA certificates.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T08:53:55.324Z. Updated 2026-04-02T13:30:44.648Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:30 WIB

Official record