Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 5721–5740 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 18 Aug 2026, 22:18 WIB

CVE-2026-62357

DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeof(int64_t) overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the unbounded dimensions…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:18:52.900Z. Updated 2026-08-19T14:36:42.019Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:36 WIB

Official record

MedPublished 18 Aug 2026, 22:15 WIB

CVE-2026-75485

Must-gather: /tmp/kubeconfig retention

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 5721 to 5740 of 12259.First page Next page

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:15:42.769Z. Updated 2026-09-05T17:08:39.455Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated06 Sep 2026, 00:08 WIB

Official record

MedPublished 18 Aug 2026, 22:15 WIB

CVE-2026-73834

Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:15:38.508Z. Updated 2026-09-05T17:08:28.740Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated06 Sep 2026, 00:08 WIB

Official record

MedPublished 18 Aug 2026, 22:14 WIB

CVE-2026-63328

Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:14:21.879Z. Updated 2026-08-18T15:48:40.395Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:48 WIB

Official record

HighPublished 18 Aug 2026, 22:13 WIB

CVE-2026-45733

Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:13:16.946Z. Updated 2026-08-18T15:33:41.704Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:33 WIB

Official record

LowPublished 18 Aug 2026, 22:11 WIB

CVE-2026-68939

Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)

Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/pyenv-local, libexec/p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:11:10.331Z. Updated 2026-08-18T18:46:12.465Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 01:46 WIB

Official record

HighPublished 18 Aug 2026, 22:09 WIB

CVE-2026-50187

Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:09:51.956Z. Updated 2026-08-18T17:46:49.745Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 00:46 WIB

Official record

HighPublished 18 Aug 2026, 22:07 WIB

CVE-2026-59825

Mastodon: Unwanted deactivation of SSL/TLS certificate verification

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate ver…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:07:14.555Z. Updated 2026-08-18T15:51:15.337Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:51 WIB

Official record

HighPublished 18 Aug 2026, 22:05 WIB

CVE-2026-69189

Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and remov…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:05:10.166Z. Updated 2026-08-18T15:32:32.233Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:32 WIB

Official record

HighPublished 18 Aug 2026, 22:02 WIB

CVE-2026-66793

Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:02:31.273Z. Updated 2026-09-05T14:23:37.148Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Sep 2026, 21:23 WIB

Official record

MedPublished 18 Aug 2026, 22:01 WIB

CVE-2026-50139

goshs: Share-link ?token=… redemption races past download limit

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:01:36.900Z. Updated 2026-08-19T14:34:47.743Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:34 WIB

Official record

MedPublished 18 Aug 2026, 21:59 WIB

CVE-2026-70657

Copyparty: file/dirkey confusion

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T14:59:54.218Z. Updated 2026-08-19T16:19:51.186Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:19 WIB

Official record

HighPublished 18 Aug 2026, 21:59 WIB

CVE-2026-50138

goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T14:59:43.416Z. Updated 2026-08-19T14:30:24.965Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:30 WIB

Official record

MedPublished 18 Aug 2026, 21:58 WIB

CVE-2026-59949

yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash JNI (StreamingXXHash32JNI / StreamingXXHash64JNI)

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T14:58:08.615Z. Updated 2026-08-18T17:46:55.526Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 00:46 WIB

Official record

HighPublished 18 Aug 2026, 21:57 WIB

CVE-2026-18534

Address bar spoofing risk in affected iOS versions of Arc Search

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T14:57:22.862Z. Updated 2026-08-18T16:04:54.354Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 23:04 WIB

Official record

HighPublished 18 Aug 2026, 21:57 WIB

CVE-2026-48798

SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, comp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T14:57:05.059Z. Updated 2026-08-18T15:28:45.711Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:28 WIB

Official record

LowPublished 18 Aug 2026, 21:55 WIB

CVE-2026-63632

ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() in onnx/version_converter/adapters/gemm_7_6.h when a Gemm node has input tensors with fewer tha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T14:55:15.923Z. Updated 2026-08-18T18:51:29.068Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 01:51 WIB

Official record

HighPublished 18 Aug 2026, 21:43 WIB

CVE-2026-71539

n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T14:43:39.066Z. Updated 2026-08-19T03:56:17.986Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 10:56 WIB

Official record

CritPublished 18 Aug 2026, 21:34 WIB

CVE-2026-59940

Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T14:34:28.703Z. Updated 2026-08-18T15:49:59.261Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:49 WIB

Official record

MedPublished 18 Aug 2026, 21:33 WIB

CVE-2026-75032

Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T14:33:47.048Z. Updated 2026-08-19T14:29:16.198Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:29 WIB

Official record