Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 5581–5600 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 02 Apr 2026, 06:15 WIB

CVE-2026-5315

Nothings stb TTF File stb_truetype.h stbtt__buf_get8 out-of-bounds

A vulnerability was determined in Nothings stb up to 1.26. The affected element is the function stbtt__buf_get8 in the library stb_truetype.h of the component TTF File Handler. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. The exploit has been publicly disclosed and may b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T23:15:12.505Z. Updated 2026-04-02T13:32:19.636Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:32 WIB

Official record

LowPublished 02 Apr 2026, 06:04 WIB

CVE-2025-66487

Multiple vulnerabilities have been addressed in IBM Aspera Shares

IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.

Excerpt language: en.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 5581 to 5600 of 5813.First page Next page

Published 2026-04-01T23:04:18.779Z. Updated 2026-04-02T13:32:28.743Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:32 WIB

Official record

MedPublished 02 Apr 2026, 06:03 WIB

CVE-2025-66486

Multiple vulnerabilities have been addressed in IBM Aspera Shares

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T23:03:45.642Z. Updated 2026-04-03T13:56:04.348Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 20:56 WIB

Official record

MedPublished 02 Apr 2026, 06:01 WIB

CVE-2025-66485

Multiple vulnerabilities have been addressed in IBM Aspera Shares

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T23:01:47.211Z. Updated 2026-04-02T18:10:25.437Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:10 WIB

Official record

HighPublished 02 Apr 2026, 06:00 WIB

CVE-2026-32929

CVE-2026-32929

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!get_macro_mem_COM. Opening a crafted V7 file may lead to information disclosure from the affected product.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T23:00:07.041Z. Updated 2026-04-02T13:32:36.370Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:32 WIB

Official record

HighPublished 02 Apr 2026, 05:59 WIB

CVE-2026-32928

CVE-2026-32928

V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CSaveData::_conv_AnimationItem. Opening a crafted V7 file may lead to arbitrary code execution on the affected product.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T22:59:39.379Z. Updated 2026-04-02T13:32:44.120Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:32 WIB

Official record

MedPublished 02 Apr 2026, 05:59 WIB

CVE-2025-66484

Multiple vulnerabilities have been addressed in IBM Aspera Shares

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T22:59:29.254Z. Updated 2026-04-02T13:49:58.262Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:49 WIB

Official record

HighPublished 02 Apr 2026, 05:59 WIB

CVE-2026-32927

CVE-2026-32927

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information disclosure from the affected product.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T22:59:21.885Z. Updated 2026-04-02T13:32:53.041Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:32 WIB

Official record

HighPublished 02 Apr 2026, 05:58 WIB

CVE-2026-32926

CVE-2026-32926

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information disclosure from the affected product.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T22:58:55.498Z. Updated 2026-04-02T13:33:02.118Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:33 WIB

Official record

HighPublished 02 Apr 2026, 05:58 WIB

CVE-2026-32925

CVE-2026-32925

V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom. Opening a crafted V7 file may lead to arbitrary code execution on the affected product.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T22:58:32.805Z. Updated 2026-04-02T13:33:08.774Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:33 WIB

Official record

MedPublished 02 Apr 2026, 05:56 WIB

CVE-2025-66483

Multiple vulnerabilities have been addressed in IBM Aspera Shares

IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T22:56:38.441Z. Updated 2026-04-02T13:33:16.193Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:33 WIB

Official record

MedPublished 02 Apr 2026, 05:50 WIB

CVE-2025-36375

IBM DataPower Gateway vulnerable to CSRF

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tran…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T22:50:51.697Z. Updated 2026-04-03T13:56:04.937Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 20:56 WIB

Official record

MedPublished 02 Apr 2026, 05:15 WIB

CVE-2026-5314

Nothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-bounds

A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the component TTF File Handler. Performing a manipulation results in out-of-bounds read. Remote exploitation of the attack is possible. The exploit has been made public and could be us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T22:15:15.789Z. Updated 2026-04-02T13:50:27.473Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:50 WIB

Official record

HighPublished 02 Apr 2026, 04:35 WIB

CVE-2026-34572

CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an account is deactivated. Due to a logic flaw in the backend design, account sta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T21:35:10.556Z. Updated 2026-04-02T13:51:10.563Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:51 WIB

Official record

HighPublished 02 Apr 2026, 04:32 WIB

CVE-2026-3987

WatchGuard Firebox Arbitrary File Write vis Path Traversal in Fireware Web UI

A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrary code in the context of an elevated system process.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T21:32:30.426Z. Updated 2026-08-10T16:46:12.527Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated10 Aug 2026, 23:46 WIB

Official record

CritPublished 02 Apr 2026, 04:32 WIB

CVE-2026-34571

CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend user management functionality. The application fails to properly sanitiz…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T21:32:16.629Z. Updated 2026-04-02T16:23:34.783Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 23:23 WIB

Official record

HighPublished 02 Apr 2026, 04:30 WIB

CVE-2026-34570

CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an account is deleted. Due to a logic flaw in the backend design, account state c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T21:30:31.415Z. Updated 2026-04-06T17:15:53.691Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 00:15 WIB

Official record

MedPublished 02 Apr 2026, 04:30 WIB

CVE-2026-5313

Nothings stb GIF Decoder stb_image.h stbi__gif_load_next denial of service

A vulnerability has been found in Nothings stb up to 2.30. This issue affects the function stbi__gif_load_next in the library stb_image.h of the component GIF Decoder. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The ven…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T21:30:13.458Z. Updated 2026-04-03T16:42:46.207Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 23:42 WIB

Official record

CritPublished 02 Apr 2026, 04:29 WIB

CVE-2026-34569

CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog categories. An attacker can inject a malicious JavaScrip…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T21:29:33.596Z. Updated 2026-04-02T18:05:04.208Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:05 WIB

Official record

CritPublished 02 Apr 2026, 04:28 WIB

CVE-2026-34568

CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog posts. An attacker can inject a malicious JavaScript pay…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T21:28:55.727Z. Updated 2026-04-02T13:51:49.965Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 20:51 WIB

Official record