Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,616 published records · 20 KEV · 4,616 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,616 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3317.2%
High1,42031%
Med1,98843%
Low2104.5%
None360.78%
Legacy00.00%
Unscored63114%

Matching records by UTC month

Feb 264,616

Signal coverage

KEV-listed: 20
With a forecast: 4,616
Unknown date: 0
Unscored severity: 631

Share of cohort: KEV 0.43% · forecast 100% · unscored 14%.

Showing 561–580 of 4,616By severity band: Critical · 9.0–10.0 331, High · 7.0–8.9 1,420, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 210, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 631

HighPublished 25 Feb 2026, 10:48 WIB

CVE-2026-27627

Karakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS

Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns `readableContentHtml`, the HTML parsing subprocess uses it directly without running it through DOMPurify. Every other content source in the crawler goes through Readability + DOMPurify, but the Reddit path …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:48:07.431Z. Updated 2026-02-25T21:20:03.257Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 04:20 WIB

Official record

HighPublished 25 Feb 2026, 10:44 WIB

CVE-2026-27639

Mercator vulnerable to stored XSS via unescaped Blade directives in display templates

Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Mercator prior to version 2026.02.22 due to the use of unescaped Blade directives (`{!! !!}`) in display templates. An authenticated user with the User role can injec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 561 to 580 of 4616.First page Next page

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:44:26.241Z. Updated 2026-02-25T15:20:41.753Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated25 Feb 2026, 22:20 WIB

Official record

HighPublished 25 Feb 2026, 10:41 WIB

CVE-2026-27636

FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOverride All` (a common configuration), an authenticated user can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:41:33.166Z. Updated 2026-02-25T15:25:24.822Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated25 Feb 2026, 22:25 WIB

Official record

CritPublished 25 Feb 2026, 10:41 WIB

CVE-2026-27637

FreeScout's Predictable Authentication Token Enables Account Takeover

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's `TokenAuth` middleware uses a predictable authentication token computed as `MD5(user_id + created_at + APP_KEY)`. This token is static (never expires/rotates), and if an attacker obtains the `APP_KEY…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:41:23.478Z. Updated 2026-02-25T15:21:52.817Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated25 Feb 2026, 22:21 WIB

Official record

MedPublished 25 Feb 2026, 10:32 WIB

CVE-2026-3147

libvips csvload.c vips_foreign_load_csv_build heap-based overflow

A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file libvips/foreign/csvload.c. The manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as b3a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:32:09.025Z. Updated 2026-02-25T15:32:34.675Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated25 Feb 2026, 22:32 WIB

Official record

CritPublished 25 Feb 2026, 10:08 WIB

CVE-2026-27743

SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection

The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The handlers read the url parameter from a GET request and interpolate it directly into SQL LIKE clauses without input validation or paramet…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:08:39.325Z. Updated 2026-05-25T23:41:49.492Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 06:41 WIB

Official record

CritPublished 25 Feb 2026, 10:08 WIB

CVE-2026-27744

SPIP tickets < 4.3.3 Unauthenticated RCE

The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:08:24.714Z. Updated 2026-03-05T01:31:25.599Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 08:31 WIB

Official record

HighPublished 25 Feb 2026, 10:08 WIB

CVE-2026-27745

SPIP interface_traduction_objets < 2.2.2 Authenticated RCE

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface workflow. The plugin incorporates untrusted request data into a hidden form field that is rendered without SPIP output filtering. Because fields prefixed with an …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:08:11.502Z. Updated 2026-03-05T01:31:26.519Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 08:31 WIB

Official record

MedPublished 25 Feb 2026, 10:07 WIB

CVE-2026-27746

SPIP jeux < 4.1.1 Reflected XSS via index Parameters

The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline. The plugin incorporates untrusted request parameters into HTML output without proper output encoding, allowing attackers to inject arbitrary script content into pages that render a jeux …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:07:57.179Z. Updated 2026-03-05T01:31:27.353Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 08:31 WIB

Official record

HighPublished 25 Feb 2026, 10:07 WIB

CVE-2026-27747

SPIP interface_traduction_objets < 2.2.2 Authenticated SQL Injection

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelines.php. When handling translation requests, the plugin reads the id_parent parameter from user-supplied input and concatenates it directly into a SQL WHERE claus…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:07:44.532Z. Updated 2026-03-05T01:31:28.148Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 08:31 WIB

Official record

MedPublished 25 Feb 2026, 10:02 WIB

CVE-2026-3146

libvips matrixload.c vips_foreign_load_matrix_header null pointer dereference

A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The identifier of the patch is d4ce337c76bff1b278d7085c3c4f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:02:09.172Z. Updated 2026-02-25T15:52:33.882Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated25 Feb 2026, 22:52 WIB

Official record

MedPublished 25 Feb 2026, 10:01 WIB

CVE-2025-5781

Information Exposure Vulnerability in Hitachi Configuration Manager, Hitachi Ops Center API Configuration Manager

Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager, Hitachi Device Manager allows Session Hijacking.This issue affects Hitachi Ops Center API Configuration Manager: from 10.0.0-00 before 11.0.5-00; Hitachi Configuration Manager: from 8.5.1-00 before 11.0.5-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T03:01:21.623Z. Updated 2026-02-26T17:00:34.754Z.

CVSS5.2v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:00 WIB

Official record

LowPublished 25 Feb 2026, 09:52 WIB

CVE-2026-27632

Talishar Vulnerable to Cross-Site Request Forgery (CSRF)

Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, the Talishar application lacks Cross-Site Request Forgery (CSRF) protections on critical state-changing endpoints, specifically within `SubmitChat.php` and other game interaction handlers. By failing to require uni…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T02:52:10.061Z. Updated 2026-02-26T21:33:41.129Z.

CVSS2.6v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 04:33 WIB

Official record

MedPublished 25 Feb 2026, 09:48 WIB

CVE-2026-27629

InvenTree Vulnerable to Server Side Template Injection (SSTI)

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.3, insecure server-side templates can be hijacked to expose secure information to the client. When generating custom batch codes, the InvenTree server makes use of a customizable jinja2 template, which can be modified by a staff user to exfil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T02:48:41.934Z. Updated 2026-02-26T21:33:40.971Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 04:33 WIB

Official record

LowPublished 25 Feb 2026, 09:45 WIB

CVE-2026-27628

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.

Excerpt language: en.

Severity low: primary CNA CVSS 1.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T02:45:37.543Z. Updated 2026-02-27T19:49:02.019Z.

CVSS1.2v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 02:49 WIB

Official record

CritPublished 25 Feb 2026, 09:43 WIB

CVE-2026-27626

OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (`checkShellArgumentSafety`) blocks several dangerous argument types but not `password`. A user supplying a `password`-typed argument can inject shell metacharacters tha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T02:43:08.189Z. Updated 2026-02-27T17:07:28.612Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:07 WIB

Official record

MedPublished 25 Feb 2026, 09:38 WIB

CVE-2026-27612

Repostat Vulnerable to Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard

Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T02:38:05.548Z. Updated 2026-02-26T21:33:40.838Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 04:33 WIB

Official record

MedPublished 25 Feb 2026, 09:36 WIB

CVE-2026-27621

TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload

TypiCMS is a multilingual content management system based on the Laravel framework. A Stored Cross-Site Scripting (XSS) vulnerability exists in the file upload module of TypiCMS prior to version 16.1.7. The application allows users with file upload permissions to upload SVG files. While there is a MIME type validation,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T02:36:12.353Z. Updated 2026-02-26T20:59:12.644Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:59 WIB

Official record

HighPublished 25 Feb 2026, 09:33 WIB

CVE-2026-27615

ADB-Explorer: UNC Path Support in ManualAdbPath Leads to Remote Code Execution (RCE)

ADB Explorer is a fluent UI for ADB on Windows. In versions prior to Beta 0.9.26022, ADB-Explorer allows the `ManualAdbPath` settings variable, which determines the path of the ADB binary to be executed, to be set to a Universal Naming Convention (UNC) path in the application's settings file. This allows an attacker to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T02:33:53.553Z. Updated 2026-02-27T17:09:58.886Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:09 WIB

Official record

CritPublished 25 Feb 2026, 09:31 WIB

CVE-2026-27614

Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event. The payload executes only if a user explicitly views the affected Stacktrace in the web UI. When Pygments returns more lines than …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T02:31:17.880Z. Updated 2026-02-25T20:01:45.861Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 03:01 WIB

Official record