Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 19 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 19
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 561–580 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 29 Oct 2026, 00:28 WIB

CVE-2026-116797

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column configuration can add event-han…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:28:33.128Z. Updated 2026-10-28T19:48:29.425Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 02:48 WIB

Official record

MedPublished 29 Oct 2026, 00:23 WIB

CVE-2026-79656

OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid J…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 561 to 580 of 16156.First page Next page

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:23:44.625Z. Updated 2026-10-28T17:23:44.625Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:23 WIB

Official record

HighPublished 29 Oct 2026, 00:23 WIB

CVE-2026-116796

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:23:02.604Z. Updated 2026-10-28T17:23:02.604Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:23 WIB

Official record

MedPublished 29 Oct 2026, 00:17 WIB

CVE-2026-58458

Don't Starve Together Memory Corruption via world_gen_data

Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:17:37.710Z. Updated 2026-10-28T17:17:37.710Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:17 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:17 WIB

CVE-2026-117501

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:17:28.215Z. Updated 2026-10-28T17:17:28.215Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:17 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:17 WIB

CVE-2026-117500

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename mad…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:17:11.051Z. Updated 2026-10-28T17:17:11.051Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:17 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:16 WIB

CVE-2026-116531

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-siz…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:16:42.065Z. Updated 2026-10-28T17:16:42.065Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:16 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:16 WIB

CVE-2026-116285

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\da-fA-F]+).*\x0D\x0A/`. On a line of hex digits whose first LF has no CR before it,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:16:16.997Z. Updated 2026-10-28T17:16:16.997Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:16 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:15 WIB

CVE-2026-116135

HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them

HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:15:50.270Z. Updated 2026-10-28T17:15:50.270Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:15 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:15 WIB

CVE-2026-116134

HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block

HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:15:31.799Z. Updated 2026-10-28T17:15:31.799Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:15 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:15 WIB

CVE-2026-116133

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again fro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:15:16.522Z. Updated 2026-10-28T17:15:16.522Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:15 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:15 WIB

CVE-2026-116132

HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk

HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:15:00.711Z. Updated 2026-10-28T17:15:00.711Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:15 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:14 WIB

CVE-2026-116131

HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts

HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored. This costs about 90 bytes of memory per…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:14:43.357Z. Updated 2026-10-28T17:14:43.357Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:14 WIB

Official record

HighPublished 29 Oct 2026, 00:14 WIB

CVE-2026-116795

RE2JS: Quadratic-time denial of service in re2js lookbehind matching

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scannin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:14:15.988Z. Updated 2026-10-28T17:14:15.988Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:14 WIB

Official record

HighPublished 29 Oct 2026, 00:06 WIB

CVE-2026-116794

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:06:57.542Z. Updated 2026-10-28T17:06:57.542Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:06 WIB

Official record

MedPublished 28 Oct 2026, 23:59 WIB

CVE-2026-82962

Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet

ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it into the headroom of the packet's first fragment, instead of allocating a separate header fragment. Before this fix the in-place path was selected purely from the build-time value of CONFIG_NET_L2_ETHERNE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:59:00.030Z. Updated 2026-10-28T16:59:00.030Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:59 WIB

Official record

HighPublished 28 Oct 2026, 23:58 WIB

CVE-2026-82961

Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode

The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_configure(), z_vrfy_gpio_pin_get_config() and z_vrfy_gpio_pin_interrupt_configure() verified only the device object (K_SYSCALL_DRIVER_GPIO() / K_SYSCALL_OBJ()) and then passed the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:58:58.927Z. Updated 2026-10-28T16:58:58.927Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:58 WIB

Official record

HighPublished 28 Oct 2026, 23:54 WIB

CVE-2026-118619

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:54:34.850Z. Updated 2026-10-28T16:54:34.850Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:54 WIB

Official record

HighPublished 28 Oct 2026, 23:54 WIB

CVE-2026-118618

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:54:29.943Z. Updated 2026-10-28T16:54:29.943Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:54 WIB

Official record

HighPublished 28 Oct 2026, 23:54 WIB

CVE-2026-118617

Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability

Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:54:24.766Z. Updated 2026-10-28T16:54:24.766Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:54 WIB

Official record