Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 5521–5540 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

LowPublished 19 Aug 2026, 03:54 WIB

CVE-2026-53759

linuxfabrik-lib: Insecure creation of SQLite databases

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who controls a local monit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:54:38.537Z. Updated 2026-08-21T19:14:49.467Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:14 WIB

Official record

HighPublished 19 Aug 2026, 03:53 WIB

CVE-2026-52817

Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who already controls that m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 5521 to 5540 of 12259.First page Next page

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:53:22.189Z. Updated 2026-08-19T19:03:29.652Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:03 WIB

Official record

MedPublished 19 Aug 2026, 03:51 WIB

CVE-2026-53457

Blueprint Studio terminal command working directory not bounded to config directory

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_components/blueprint_studio/backend/terminal_manager.py accepted a cwd working-directory parameter and checked only whether the directory existed, without…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:51:01.913Z. Updated 2026-08-19T19:01:58.141Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:01 WIB

Official record

MedPublished 19 Aug 2026, 03:50 WIB

CVE-2026-53456

Blueprint Studio terminal SSH private key written to disk

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom_components/blueprint_studio/backend/terminal_manager.py wrote SSH private-key material to a file under the Home Assistant configuration directory before apply…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:50:21.016Z. Updated 2026-08-19T18:20:06.837Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:20 WIB

Official record

HighPublished 19 Aug 2026, 03:49 WIB

CVE-2026-53455

Blueprint Studio Git credential helper command injection

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in custom_components/blueprint_studio/backend/git_manager.py by interpolating the configured Git username and token directly into executable helper script…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:49:36.015Z. Updated 2026-08-19T15:25:05.473Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 22:25 WIB

Official record

MedPublished 19 Aug 2026, 03:48 WIB

CVE-2026-53454

Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials file for the user running…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:48:58.190Z. Updated 2026-08-21T19:14:06.615Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:14 WIB

Official record

HighPublished 19 Aug 2026, 03:48 WIB

CVE-2026-53453

Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization boundary. Affected sur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:48:20.578Z. Updated 2026-08-19T13:17:06.706Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 20:17 WIB

Official record

MedPublished 19 Aug 2026, 03:47 WIB

CVE-2026-53458

Blueprint Studio API exposed internal exception details

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could contain internal filesyste…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:47:25.772Z. Updated 2026-08-19T13:37:30.683Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 20:37 WIB

Official record

HighPublished 19 Aug 2026, 03:40 WIB

CVE-2026-15571

Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client

A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:40:17.770Z. Updated 2026-08-20T14:07:09.247Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 21:07 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76045

CVE-2026-76045

Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:28.987Z. Updated 2026-08-20T03:55:30.123Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76038

CVE-2026-76038

Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:28.694Z. Updated 2026-08-20T03:55:31.250Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76047

CVE-2026-76047

Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:28.437Z. Updated 2026-08-20T03:55:32.392Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76041

CVE-2026-76041

Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:28.156Z. Updated 2026-08-19T11:18:45.089Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 18:18 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76043

CVE-2026-76043

Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:27.736Z. Updated 2026-08-20T03:55:33.512Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76046

CVE-2026-76046

Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:27.388Z. Updated 2026-08-20T03:55:34.751Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76042

CVE-2026-76042

Use of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:27.107Z. Updated 2026-08-19T11:23:13.438Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 18:23 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76035

CVE-2026-76035

Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:26.830Z. Updated 2026-08-20T03:55:35.870Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76040

CVE-2026-76040

Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:26.545Z. Updated 2026-08-20T03:55:36.962Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76039

CVE-2026-76039

Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:26.177Z. Updated 2026-08-19T11:26:15.452Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 18:26 WIB

Official record

UnscoredPublished 19 Aug 2026, 03:31 WIB

CVE-2026-76044

CVE-2026-76044

Race condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T20:31:25.874Z. Updated 2026-08-20T03:55:38.090Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record