Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 5161–5180 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 04 Apr 2026, 03:45 WIB

CVE-2026-34511

OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter

OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:45:41.499Z. Updated 2026-09-24T14:17:31.108Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:17 WIB

Official record

HighPublished 04 Apr 2026, 03:28 WIB

CVE-2026-22665

prompts.chat Identity Confusion via Case-Sensitive Username Handling

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive and case-insensitive handling of usernames across write and read paths, allowing attackers to create case-variant usernames that bypass uniqueness checks. Attackers can exploit non-deterministic usernam…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 5161 to 5180 of 5813.First page Next page

Published 2026-04-03T20:28:10.061Z. Updated 2026-07-14T15:53:25.291Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record

HighPublished 04 Apr 2026, 03:27 WIB

CVE-2026-22664

prompts.chat SSRF via Fal.ai Media Status Polling

prompts.chat prior to commit 30a8f04 contains a server-side request forgery vulnerability in the Fal.ai media status polling feature that allows authenticated users to perform arbitrary outbound requests by supplying attacker-controlled URLs in the token parameter. Attackers can exploit the lack of URL validation to di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:27:48.247Z. Updated 2026-07-14T15:53:24.596Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record

HighPublished 04 Apr 2026, 03:27 WIB

CVE-2026-22663

prompts.chat Authorization Bypass Information Disclosure

prompts.chat prior to commit 7b81836 contains multiple authorization bypass vulnerabilities due to missing isPrivate checks across API endpoints and page metadata generation that allow unauthorized users to access sensitive data associated with private prompts. Attackers can exploit these missing authorization checks t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:27:25.037Z. Updated 2026-07-14T15:53:23.925Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record

MedPublished 04 Apr 2026, 03:27 WIB

CVE-2026-22662

prompts.chat Blind SSRF via media-generate

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests to the /api/media-gene…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:27:03.156Z. Updated 2026-07-14T15:53:23.237Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record

HighPublished 04 Apr 2026, 03:26 WIB

CVE-2026-22661

prompts.chat Path Traversal via Skill File Handling

prompts.chat prior to commit 0f8d4c3 contains a path traversal vulnerability in skill file handling that allows attackers to write arbitrary files to the client system by crafting malicious ZIP archives with unsanitized filenames containing path traversal sequences. Attackers can exploit missing server-side filename va…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:26:29.340Z. Updated 2026-07-14T15:53:22.554Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated14 Jul 2026, 22:53 WIB

Official record

HighPublished 04 Apr 2026, 03:26 WIB

CVE-2025-10681

Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials

Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:26:12.913Z. Updated 2026-04-06T14:39:20.062Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 21:39 WIB

Official record

CritPublished 04 Apr 2026, 03:23 WIB

CVE-2026-25197

Gardyn Cloud API Authorization Bypass Through User-Controlled Key

A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:23:20.083Z. Updated 2026-04-07T14:20:31.044Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:20 WIB

Official record

CritPublished 04 Apr 2026, 03:20 WIB

CVE-2026-28766

Gardyn Cloud API Missing Authentication for Critical Function

A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:20:57.302Z. Updated 2026-04-07T14:22:53.379Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:22 WIB

Official record

HighPublished 04 Apr 2026, 03:19 WIB

CVE-2020-37216

Hirschmann HiOS EtherNet/IP Stack Denial of Service

Hirschmann HiOS devices versions prior to 08.1.00 and 07.1.01 contain a denial of service vulnerability in the EtherNet/IP stack where improper handling of packet length fields allows remote attackers to crash or hang the device. Attackers can send specially crafted UDP EtherNet/IP packets with a length value larger t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:19:25.269Z. Updated 2026-07-15T01:24:29.177Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

MedPublished 04 Apr 2026, 03:18 WIB

CVE-2026-28767

Gardyn Cloud API Missing Authentication for Critical Function

A specific administrative endpoint notifications is accessible without proper authentication.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:18:05.470Z. Updated 2026-04-07T14:23:23.456Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:23 WIB

Official record

HighPublished 04 Apr 2026, 03:15 WIB

CVE-2026-32646

Gardyn Cloud API Missing Authentication for Critical Function

A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:15:45.736Z. Updated 2026-04-07T14:24:15.629Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:24 WIB

Official record

HighPublished 04 Apr 2026, 03:15 WIB

CVE-2022-4987

Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Code Execution

Hirschmann Industrial HiVision version 08.1.03 prior to 08.1.04 and 08.2.00 contains a vulnerability in the execution of user-configured external applications that allows a local attacker to execute arbitrary binaries. Due to insufficient path sanitization, an attacker can place a malicious binary in the execution path…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:15:24.713Z. Updated 2026-05-25T23:41:20.694Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 06:41 WIB

Official record

HighPublished 04 Apr 2026, 03:15 WIB

CVE-2026-35558

Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver

Improper neutralization of special elements in the authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to execute arbitrary code or redirect authentication flows by using specially crafted connection parameters that are processed by the driver during user-initiated authentic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:15:09.386Z. Updated 2026-10-20T18:17:59.411Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated21 Oct 2026, 01:17 WIB

Official record

HighPublished 04 Apr 2026, 03:13 WIB

CVE-2026-35559

Out-of-bounds write in query processing components in Amazon Athena ODBC driver

Out-of-bounds write in the query processing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to crash the driver by using specially crafted data that is processed by the driver during query operations. To remediate this issue, users should upgrade to version 2.1.0.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:13:29.590Z. Updated 2026-10-20T18:18:19.394Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated21 Oct 2026, 01:18 WIB

Official record

HighPublished 04 Apr 2026, 03:13 WIB

CVE-2026-5485

OS command injection in Amazon Athena ODBC driver on Linux

OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat actor to execute arbitrary code by using specially crafted connection parameters that are loaded by the driver during a local user-initiated connection. To remediate this issue…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:13:14.946Z. Updated 2026-10-20T18:17:35.331Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated21 Oct 2026, 01:17 WIB

Official record

MedPublished 04 Apr 2026, 03:12 WIB

CVE-2026-25742

Zulip: Anonymous File Access After Disabling Spectator Access

Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS_ENABLED) is disabled, attachments originating from web-public streams can still be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:12:07.296Z. Updated 2026-04-08T18:53:28.819Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 01:53 WIB

Official record

MedPublished 04 Apr 2026, 03:11 WIB

CVE-2026-32662

Gardyn Cloud API Active Debug Code

Development and test API endpoints are present that mirror production functionality.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:11:56.176Z. Updated 2026-04-06T14:51:59.384Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 21:51 WIB

Official record

HighPublished 04 Apr 2026, 03:10 WIB

CVE-2026-35562

Allocation of resources without limits in parsing components in Amazon Athena ODBC driver

Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to cause a denial of service by delivering crafted input that triggers excessive resource consumption during the driver's parsing operations. To remediate this issue, users should u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:10:51.206Z. Updated 2026-10-20T18:19:42.471Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Oct 2026, 01:19 WIB

Official record

CritPublished 04 Apr 2026, 03:10 WIB

CVE-2026-35561

Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver

Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to intercept or hijack authentication sessions due to insufficient protections in the browser-based authentication flows. To remediate this issue, users …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T20:10:40.591Z. Updated 2026-10-20T18:15:58.776Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated21 Oct 2026, 01:15 WIB

Official record