Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 5581–5600 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 19 Aug 2026, 02:10 WIB

CVE-2026-73529

Plainpad Missing Rate Limiting via POST /v1/sessions

Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleton, leaving the API thro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T19:10:33.389Z. Updated 2026-08-18T19:30:33.026Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:30 WIB

Official record

MedPublished 19 Aug 2026, 02:08 WIB

CVE-2026-71322

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 5581 to 5600 of 12259.First page Next page

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T19:08:23.118Z. Updated 2026-08-19T18:20:52.603Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:20 WIB

Official record

MedPublished 19 Aug 2026, 02:06 WIB

CVE-2026-19670

Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location bl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T19:06:44.659Z. Updated 2026-08-18T19:47:33.551Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:47 WIB

Official record

MedPublished 19 Aug 2026, 02:06 WIB

CVE-2026-71317

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to cryptography…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T19:06:27.618Z. Updated 2026-08-19T19:21:56.406Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:21 WIB

Official record

HighPublished 19 Aug 2026, 02:05 WIB

CVE-2026-70666

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and fina…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T19:05:26.621Z. Updated 2026-08-19T18:20:58.433Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:20 WIB

Official record

HighPublished 19 Aug 2026, 02:03 WIB

CVE-2026-71303

Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T19:03:55.524Z. Updated 2026-08-18T19:46:07.340Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:46 WIB

Official record

HighPublished 19 Aug 2026, 02:02 WIB

CVE-2026-71307

Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T19:02:14.056Z. Updated 2026-08-18T19:35:04.763Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:35 WIB

Official record

HighPublished 19 Aug 2026, 02:00 WIB

CVE-2026-71308

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an app…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T19:00:40.503Z. Updated 2026-08-18T19:34:59.015Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:34 WIB

Official record

MedPublished 19 Aug 2026, 01:55 WIB

CVE-2026-70667

Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)

Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:55:44.317Z. Updated 2026-08-19T15:16:47.910Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 22:16 WIB

Official record

MedPublished 19 Aug 2026, 01:53 WIB

CVE-2026-55164

Lemur: Plaintext password storage in Lemur user-update path

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes throu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:53:12.483Z. Updated 2026-08-18T19:15:10.532Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:15 WIB

Official record

MedPublished 19 Aug 2026, 01:52 WIB

CVE-2026-55162

Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate thro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:52:25.801Z. Updated 2026-08-19T15:15:42.749Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 22:15 WIB

Official record

CritPublished 19 Aug 2026, 01:51 WIB

CVE-2026-55166

Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restriction and trigger AcmeHandler.setup_acme_client to make backend requests. An attacker could target cloud instance metadata or internal services from L…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:51:41.495Z. Updated 2026-08-18T19:34:19.740Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:34 WIB

Official record

MedPublished 19 Aug 2026, 01:50 WIB

CVE-2026-55163

Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership

Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data["users"] and data["name"] to service.update, allowing a no…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:50:58.130Z. Updated 2026-08-19T18:21:06.074Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:21 WIB

Official record

MedPublished 19 Aug 2026, 01:49 WIB

CVE-2026-55165

Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] from an unverified token and passed that attacker-controlled value to decode_with_multiple_secrets. PyJWT 2.x rejects alg=none with the configured key, so the flaw…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:49:59.538Z. Updated 2026-08-18T19:35:55.129Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:35 WIB

Official record

HighPublished 19 Aug 2026, 01:35 WIB

CVE-2026-17106

Tar extraction in moby/go-archive can write outside the destination directory via link following

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:35:13.465Z. Updated 2026-08-19T03:56:16.526Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 10:56 WIB

Official record

MedPublished 19 Aug 2026, 01:25 WIB

CVE-2025-9211

Cross-site scripting in Otalio Ship Property Management System

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:25:51.499Z. Updated 2026-08-18T18:51:43.637Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 01:51 WIB

Official record

HighPublished 19 Aug 2026, 01:25 WIB

CVE-2025-9210

Missing JSON Web Token signature validation in Otalio Ship Property Management System

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:25:47.427Z. Updated 2026-08-18T18:52:14.404Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 01:52 WIB

Official record

MedPublished 19 Aug 2026, 01:24 WIB

CVE-2026-47630

CVE-2026-47630

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:24:01.079Z. Updated 2026-08-20T02:05:51.728Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 09:05 WIB

Official record

HighPublished 19 Aug 2026, 01:24 WIB

CVE-2026-47629

CVE-2026-47629

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:24:00.197Z. Updated 2026-08-20T02:04:00.102Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 09:04 WIB

Official record

HighPublished 19 Aug 2026, 01:23 WIB

CVE-2026-47628

CVE-2026-47628

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T18:23:59.300Z. Updated 2026-08-20T02:03:39.940Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 09:03 WIB

Official record