Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 5701–5720 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

CritPublished 01 Apr 2026, 19:22 WIB

CVE-2026-29014

MetInfo CMS Unauthenticated PHP Code Injection RCE

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T12:22:42.420Z. Updated 2026-07-14T18:39:51.919Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:39 WIB

Official record

HighPublished 01 Apr 2026, 19:18 WIB

CVE-2026-22768

CVE-2026-22768

Dell AppSync, version(s) 4.6.0, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 5701 to 5720 of 5813.First page Next page

Published 2026-04-01T12:18:38.716Z. Updated 2026-04-02T03:56:01.058Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 10:56 WIB

Official record

HighPublished 01 Apr 2026, 19:07 WIB

CVE-2026-22767

CVE-2026-22767

Dell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T12:07:50.386Z. Updated 2026-04-01T19:04:27.520Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 02:04 WIB

Official record

MedPublished 01 Apr 2026, 18:28 WIB

CVE-2026-25601

Credential Exposure vulnerability in MEPIS RM

A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user passwords before storing them…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T11:28:57.110Z. Updated 2026-04-01T12:35:48.644Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 19:35 WIB

Official record

MedPublished 01 Apr 2026, 17:07 WIB

CVE-2026-24096

Insufficient permission validation on multiple REST API Quick Setup endpoints

Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged users to perform unauthorized actions or obtain sensitive information

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T10:07:21.670Z. Updated 2026-04-01T12:37:04.819Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 19:37 WIB

Official record

MedPublished 01 Apr 2026, 17:03 WIB

CVE-2026-0932

CVE-2026-0932

Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T10:03:27.785Z. Updated 2026-04-01T12:38:30.875Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 19:38 WIB

Official record

MedPublished 01 Apr 2026, 17:00 WIB

CVE-2026-1879

Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload

A vulnerability was detected in Harvard University IQSS Dataverse up to 6.8. This affects an unknown function of the file /ThemeAndWidgets.xhtml of the component Theme Customization. Performing a manipulation of the argument uploadLogo results in unrestricted upload. Remote exploitation of the attack is possible. The e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T10:00:10.991Z. Updated 2026-04-01T13:08:49.098Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 20:08 WIB

Official record

MedPublished 01 Apr 2026, 16:49 WIB

CVE-2024-53828

Ericsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure Vulnerability

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degradation.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T09:49:18.214Z. Updated 2026-04-01T12:39:41.380Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 19:39 WIB

Official record

MedPublished 01 Apr 2026, 16:03 WIB

CVE-2026-21630

Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T09:03:49.098Z. Updated 2026-04-01T19:33:26.760Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 02:33 WIB

Official record

HighPublished 01 Apr 2026, 16:03 WIB

CVE-2026-23898

Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T09:03:40.185Z. Updated 2026-08-12T13:56:53.399Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated12 Aug 2026, 20:56 WIB

Official record

MedPublished 01 Apr 2026, 16:03 WIB

CVE-2026-21629

Joomla! Core - [20260301] - ACL hardening in com_ajax

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T09:03:37.772Z. Updated 2026-04-01T19:32:37.680Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 02:32 WIB

Official record

HighPublished 01 Apr 2026, 16:03 WIB

CVE-2026-23899

Joomla! Core - [20260306] - Improper access check in webservice endpoints

An improper access check allows unauthorized access to webservice endpoints.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T09:03:18.563Z. Updated 2026-04-02T07:56:08.444Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 14:56 WIB

Official record

MedPublished 01 Apr 2026, 16:03 WIB

CVE-2026-21631

Joomla! Core - [20260303] - XSS vector in com_associations comparison view

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T09:03:17.208Z. Updated 2026-04-02T05:09:59.076Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 12:09 WIB

Official record

MedPublished 01 Apr 2026, 16:03 WIB

CVE-2026-21632

Joomla! Core - [20260304] - XSS vectors in various article title outputs

Lack of output escaping for article titles leads to XSS vectors in various locations.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T09:03:11.213Z. Updated 2026-04-02T05:09:54.642Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 12:09 WIB

Official record

MedPublished 01 Apr 2026, 15:51 WIB

CVE-2026-34889

WordPress Ultimate Addons for WPBakery Page Builder plugin < 3.21.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows DOM-Based XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a before 3.21.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T08:51:32.192Z. Updated 2026-04-01T13:29:40.506Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 20:29 WIB

Official record

HighPublished 01 Apr 2026, 15:36 WIB

CVE-2026-23411

apparmor: fix race between freeing data and fs accessing it

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can aand does live beyond that point and it is possi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T08:36:39.819Z. Updated 2026-08-05T12:21:31.465Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:21 WIB

Official record

HighPublished 01 Apr 2026, 15:36 WIB

CVE-2026-23410

apparmor: fix race on rawdata dereference

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-after-free situation: because the rawdata inodes are not refcounted, an attacker can start open()ing one of the rawdata files, and at the same time remove the las…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T08:36:39.202Z. Updated 2026-08-05T12:21:30.404Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:21 WIB

Official record

UnscoredPublished 01 Apr 2026, 15:36 WIB

CVE-2026-23409

apparmor: fix differential encoding verification

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix differential encoding verification Differential encoding allows loops to be created if it is abused. To prevent this the unpack should verify that a diff-encode chain terminates. Unfortunately the differential encode verification had t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T08:36:38.516Z. Updated 2026-05-11T22:06:21.118Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:06 WIB

Official record

HighPublished 01 Apr 2026, 15:36 WIB

CVE-2026-23408

apparmor: Fix double free of ns_name in aa_replace_profiles()

In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL after 1071 error = aa_unpack(udata, &lh, &ns_name); and if ent->ns_name contains an ns_name in 1089 } else if (ent->ns_name) { then ns_name is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T08:36:37.873Z. Updated 2026-08-05T12:21:29.316Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:21 WIB

Official record

HighPublished 01 Apr 2026, 15:36 WIB

CVE-2026-23407

apparmor: fix missing bounds check on DEFAULT table in verify_dfa()

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() The verify_dfa() function only checks DEFAULT_TABLE bounds when the state is not differentially encoded. When the verification loop traverses the differential encoding chain, it rea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-01T08:36:37.197Z. Updated 2026-08-05T12:21:28.162Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:21 WIB

Official record