Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 5921–5940 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 18 Aug 2026, 19:16 WIB

CVE-2026-23929

Prototype pollution leading to stored XSS

Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T12:16:15.322Z. Updated 2026-08-19T03:55:58.598Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 10:55 WIB

Official record

MedPublished 18 Aug 2026, 19:15 WIB

CVE-2026-1199

API and Frontend login lockout race condition

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T12:15:29.646Z. Updated 2026-08-18T13:35:41.648Z.

Showing 5921 to 5940 of 12259.First page Next page

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:35 WIB

Official record

MedPublished 18 Aug 2026, 19:15 WIB

CVE-2026-75778

code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T12:15:10.782Z. Updated 2026-08-19T14:27:31.139Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:27 WIB

Official record

LowPublished 18 Aug 2026, 19:13 WIB

CVE-2026-23922

Email media OAuth secret leak to Super Admin

The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T12:13:38.438Z. Updated 2026-08-18T16:02:15.215Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 23:02 WIB

Official record

MedPublished 18 Aug 2026, 18:48 WIB

CVE-2026-5224

Sensitive Data Exposure in Kriptek Crypto's Cryptosim

Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive Data. This issue affects Cryptosim: before 3.1.0.229.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:48:14.903Z. Updated 2026-08-18T13:26:55.598Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:26 WIB

Official record

HighPublished 18 Aug 2026, 18:23 WIB

CVE-2026-15585

Path Traversal in AKIN Software's Wolvox9 ERP

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 before 26.02.22.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:23:26.689Z. Updated 2026-08-18T13:27:49.955Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:27 WIB

Official record

HighPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75855

ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:57.922Z. Updated 2026-08-19T14:25:14.590Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:25 WIB

Official record

CritPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75854

ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:57.266Z. Updated 2026-10-08T15:51:42.518Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:51 WIB

Official record

HighPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75853

ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database

ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:56.591Z. Updated 2026-08-18T15:04:37.804Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:04 WIB

Official record

CritPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75852

ArcadeDB MongoDB wire protocol authentication bypass cross-database

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:55.908Z. Updated 2026-08-18T13:35:48.716Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:35 WIB

Official record

CritPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75851

ArcadeDB before 26.8.1 Authentication Bypass via Async Command

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:55.216Z. Updated 2026-08-18T13:30:19.587Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:30 WIB

Official record

LowPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75850

ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers

ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:54.194Z. Updated 2026-08-19T14:24:21.074Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:24 WIB

Official record

HighPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75846

ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION

ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:53.253Z. Updated 2026-08-18T15:03:02.892Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:03 WIB

Official record

MedPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75845

ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:52.584Z. Updated 2026-08-18T15:12:23.061Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:12 WIB

Official record

HighPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75844

ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:51.911Z. Updated 2026-08-18T13:35:55.096Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:35 WIB

Official record

CritPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75843

ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:51.249Z. Updated 2026-08-18T13:34:09.841Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:34 WIB

Official record

HighPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75842

ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:50.570Z. Updated 2026-08-19T14:23:31.399Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:23 WIB

Official record

MedPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75841

ArcadeDB before 26.8.1 Denial of Service via range()

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:49.914Z. Updated 2026-08-18T14:16:15.855Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:16 WIB

Official record

HighPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75840

ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex

ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:49.235Z. Updated 2026-08-18T15:11:08.737Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:11 WIB

Official record

MedPublished 18 Aug 2026, 18:19 WIB

CVE-2026-75839

ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate but do not authorize access. On an ArcadeDB HA cluster (only reachable when arcadedb.ha.ena…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T11:19:48.550Z. Updated 2026-08-18T13:36:03.478Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:36 WIB

Official record