Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 5641–5660 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 02 Apr 2026, 02:48 WIB

CVE-2026-34748

@payloadcms/next has Stored XSS in Admin Panel

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T19:48:10.297Z. Updated 2026-04-02T16:24:38.880Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 23:24 WIB

Official record

HighPublished 02 Apr 2026, 02:45 WIB

CVE-2026-34747

Payload has an SQL Injection via Query Handling

Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 5641 to 5660 of 5813.First page Next page

Published 2026-04-01T19:45:24.463Z. Updated 2026-04-04T03:07:40.291Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated04 Apr 2026, 10:07 WIB

Official record

MedPublished 02 Apr 2026, 02:45 WIB

CVE-2026-5311

D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control

A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function Webdav_Access_List of the file…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T19:45:14.221Z. Updated 2026-04-02T15:27:57.427Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 22:27 WIB

Official record

HighPublished 02 Apr 2026, 02:43 WIB

CVE-2026-34746

Payload has Authenticated SSRF via Upload Functionality

Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HT…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T19:43:16.700Z. Updated 2026-04-02T15:12:09.290Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 22:12 WIB

Official record

HighPublished 02 Apr 2026, 01:09 WIB

CVE-2026-35000

ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T18:09:35.793Z. Updated 2026-07-14T18:40:38.826Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:40 WIB

Official record

LowPublished 02 Apr 2026, 00:49 WIB

CVE-2026-5199

Cross Namespace Access via Batch Operation

A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Exploitation requires the attacker to know or guess specific victim workflow ID(s) and, for signal operations, signal names. This was due to a bug introduced in Tempo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T17:49:15.464Z. Updated 2026-04-01T18:24:50.983Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 01:24 WIB

Official record

CritPublished 02 Apr 2026, 00:42 WIB

CVE-2026-34751

Payload has Unvalidated Input in Password Recovery Endpoints

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in ve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T17:42:45.827Z. Updated 2026-04-04T03:06:17.817Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Apr 2026, 10:06 WIB

Official record

MedPublished 02 Apr 2026, 00:39 WIB

CVE-2026-34447

ONNX: External Data Symlink Traversal

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T17:39:38.129Z. Updated 2026-04-01T19:14:38.114Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 02:14 WIB

Official record

MedPublished 02 Apr 2026, 00:37 WIB

CVE-2026-34446

ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This iss…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T17:37:54.737Z. Updated 2026-04-02T14:10:36.637Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 21:10 WIB

Official record

HighPublished 02 Apr 2026, 00:33 WIB

CVE-2026-27489

ONNX: Path Traversal via Symlink

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T17:33:51.281Z. Updated 2026-07-15T01:14:13.726Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:14 WIB

Official record

HighPublished 02 Apr 2026, 00:30 WIB

CVE-2026-34445

ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T17:30:19.994Z. Updated 2026-04-01T18:00:14.120Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 01:00 WIB

Official record

MedPublished 02 Apr 2026, 00:25 WIB

CVE-2026-34397

himmelblau: NSS fake-primary group lookup reintroduces name collision risk

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T17:25:06.034Z. Updated 2026-04-04T03:05:13.451Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated04 Apr 2026, 10:05 WIB

Official record

HighPublished 02 Apr 2026, 00:05 WIB

CVE-2026-34376

PdfDing: Password-protected share bypass via direct serve endpoint

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.0, an access-control vulnerability allows unauthenticated users to retrieve password-protected shared PDFs by directly calling the file-serving endpoint without completing the password ve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T17:05:22.831Z. Updated 2026-04-01T18:53:12.317Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 01:53 WIB

Official record

HighPublished 02 Apr 2026, 00:04 WIB

CVE-2026-34236

Auth0 PHP SDK Insufficient Entropy in Cookie Encryption

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T17:04:53.378Z. Updated 2026-04-01T17:59:59.001Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 00:59 WIB

Official record

HighPublished 02 Apr 2026, 00:02 WIB

CVE-2026-34222

Open WebUI has Broken Access Control in Tool Valves

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T17:02:21.846Z. Updated 2026-04-04T03:03:42.269Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated04 Apr 2026, 10:03 WIB

Official record

CritPublished 01 Apr 2026, 23:59 WIB

CVE-2026-34159

llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend

llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's deserialize_tensor() skips all bounds validation when a tensor's buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPH_COMPUTE messages. Combined with pointer leaks …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T16:59:59.967Z. Updated 2026-04-02T03:56:11.820Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 10:56 WIB

Official record

HighPublished 01 Apr 2026, 23:59 WIB

CVE-2026-34076

Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T16:59:21.828Z. Updated 2026-04-01T18:00:23.118Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 01:00 WIB

Official record

HighPublished 01 Apr 2026, 23:51 WIB

CVE-2026-34072

cronmaster: Middleware authentication bypass enabling unauthorized page access and server-action execution

Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware’s session-validation …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T16:51:33.306Z. Updated 2026-04-01T17:45:11.248Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 00:45 WIB

Official record

MedPublished 01 Apr 2026, 23:34 WIB

CVE-2026-20090

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerabil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T16:34:57.753Z. Updated 2026-04-22T19:09:52.272Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated23 Apr 2026, 02:09 WIB

Official record

MedPublished 01 Apr 2026, 23:34 WIB

CVE-2026-20089

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerabil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T16:34:48.793Z. Updated 2026-04-22T19:09:56.418Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated23 Apr 2026, 02:09 WIB

Official record