Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 5121–5140 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 04 Apr 2026, 05:50 WIB

CVE-2026-34936

PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

PraisonAI is a multi-agent teams system. Prior to version 4.5.90, passthrough() and apassthrough() in praisonai accept a caller-controlled api_base parameter that is concatenated with endpoint and passed directly to httpx.Client.request() when the litellm primary path raises AttributeError. No URL scheme validation, pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:50:04.922Z. Updated 2026-04-06T15:41:58.898Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:41 WIB

Official record

CritPublished 04 Apr 2026, 05:49 WIB

CVE-2017-20234

GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String

GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by exploiting a hardcoded string in the authentication mechanism. Attackers can bypass login controls to access administrative functions and sensitive switch con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 5121 to 5140 of 5813.First page Next page

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:49:58.377Z. Updated 2026-10-01T19:19:01.356Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

CritPublished 04 Apr 2026, 05:49 WIB

CVE-2026-34934

PraisonAI: Second-Order SQL Injection in `get_all_user_threads`

PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via update_thread. When the application loads the thread list, the injected payload…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:49:12.947Z. Updated 2026-04-06T13:16:17.048Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated06 Apr 2026, 20:16 WIB

Official record

CritPublished 04 Apr 2026, 05:48 WIB

CVE-2026-34935

PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.open_process() with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:48:21.261Z. Updated 2026-04-06T19:04:26.478Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 02:04 WIB

Official record

MedPublished 04 Apr 2026, 05:47 WIB

CVE-2017-20233

Hirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traffic Bypass

Hirschmann HiLCOS products OpenBAT, BAT450, WLC, BAT867 contains a firewall filtering vulnerability that fails to correctly filter IPv4 multicast and broadcast traffic when management IP address filtering is disabled, allowing configured filter rules to be bypassed. Attackers with network access can inject or observe m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:47:07.496Z. Updated 2026-05-25T23:40:56.325Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 06:40 WIB

Official record

CritPublished 04 Apr 2026, 05:44 WIB

CVE-2018-25236

Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit imp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:44:43.486Z. Updated 2026-07-15T01:23:30.343Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

MedPublished 04 Apr 2026, 05:43 WIB

CVE-2026-34933

Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:43:26.683Z. Updated 2026-04-11T18:09:34.774Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated12 Apr 2026, 01:09 WIB

Official record

HighPublished 04 Apr 2026, 05:41 WIB

CVE-2026-34824

Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:41:34.828Z. Updated 2026-04-06T15:42:06.793Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:42 WIB

Official record

CritPublished 04 Apr 2026, 05:39 WIB

CVE-2026-34612

Kestra: Remote Code Execution via SQL Injection

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a cr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:39:31.434Z. Updated 2026-04-06T16:10:10.415Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated06 Apr 2026, 23:10 WIB

Official record

CritPublished 04 Apr 2026, 05:37 WIB

CVE-2021-4477

Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass

Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers can exploit this vulnerability by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while simultaneously using an IPv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:37:45.879Z. Updated 2026-04-06T13:17:07.744Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 20:17 WIB

Official record

MedPublished 04 Apr 2026, 05:37 WIB

CVE-2026-34788

Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters

Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168. The updateTagName() function directly interpolates user input into the SQL query string without using parameterized queries or proper escaping ($this->db->escape…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:37:08.658Z. Updated 2026-04-06T19:03:54.134Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 02:03 WIB

Official record

MedPublished 04 Apr 2026, 05:36 WIB

CVE-2026-34787

Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter

Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed (see pot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:36:36.418Z. Updated 2026-04-06T13:17:52.939Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated06 Apr 2026, 20:17 WIB

Official record

HighPublished 04 Apr 2026, 05:35 WIB

CVE-2026-34607

Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE

Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function (include/lib/common.php:793). When extracting ZIP archives (plugin/template uploads, backup imports), the function calls $zip->extractTo($path) without sanitizing ZIP entry names…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:35:56.664Z. Updated 2026-04-06T15:42:13.270Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:42 WIB

Official record

MedPublished 04 Apr 2026, 05:31 WIB

CVE-2026-34229

Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass

Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vulnerability in emlog comment module via URI scheme validation bypass. This issue has been patched in version 2.6.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:31:44.971Z. Updated 2026-04-06T19:02:14.476Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 02:02 WIB

Official record

HighPublished 04 Apr 2026, 05:28 WIB

CVE-2026-34228

Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write

Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The server first downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root directory. This process does not validat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:28:45.911Z. Updated 2026-04-06T13:18:48.484Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 20:18 WIB

Official record

HighPublished 04 Apr 2026, 05:10 WIB

CVE-2017-20238

Hirschmann Industrial HiVision Improper Authorization Privilege Escalation

Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:10:18.157Z. Updated 2026-05-25T23:40:58.337Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 06:40 WIB

Official record

MedPublished 04 Apr 2026, 05:10 WIB

CVE-2026-35468

nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history index

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:10:06.156Z. Updated 2026-04-06T17:22:04.161Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 00:22 WIB

Official record

HighPublished 04 Apr 2026, 05:09 WIB

CVE-2026-33184

nimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panic

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, the discovery handler accepts a peer-controlled limit during handshake and stores it unchanged. The immediate HandshakeAck path then honors limit = 0 and returns zero…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:09:01.430Z. Updated 2026-04-06T13:19:33.717Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated06 Apr 2026, 20:19 WIB

Official record

MedPublished 04 Apr 2026, 05:07 WIB

CVE-2026-34061

nimiq/core-rs-albatross: Macro block proposal interlink bug

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an elected validator proposer can send an election macro block whose header.interlink does not match the canonical next interlink. Honest validators accept that propo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:07:40.969Z. Updated 2026-04-06T15:42:21.027Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:42 WIB

Official record

MedPublished 04 Apr 2026, 05:04 WIB

CVE-2026-34052

LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)

LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T22:04:10.519Z. Updated 2026-04-06T18:59:04.966Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated07 Apr 2026, 01:59 WIB

Official record