Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 521–540 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 28 Mar 2026, 05:10 WIB

CVE-2026-33991

WeGIA has SQL Injection in deletar_tag.php

WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sistema/deletar_tag.php` uses `extract($_REQUEST)` on line 14 and directly concatenates the `$id_tag` variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches the vulnerabi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T22:10:51.350Z. Updated 2026-03-31T19:09:51.018Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 02:09 WIB

Official record

MedPublished 28 Mar 2026, 05:08 WIB

CVE-2026-33936

python-ecdsa: Denial of Service via improper DER length validation in crafted private keys

The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing fu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 521 to 540 of 6236.First page Next page

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T22:08:22.868Z. Updated 2026-04-01T13:44:46.297Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 20:44 WIB

Official record

MedPublished 28 Mar 2026, 05:03 WIB

CVE-2026-4992

wandb OpenUI HTMLAnnotator server.py get_share HTML injection

A flaw has been found in wandb OpenUI up to 1.0. This affects the function create_share/get_share of the file backend/openui/server.py of the component HTMLAnnotator Component. Executing a manipulation of the argument ID can lead to HTML injection. The attack may be performed from remote. The exploit has been published…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T22:03:46.340Z. Updated 2026-03-30T14:53:55.953Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:53 WIB

Official record

MedPublished 28 Mar 2026, 05:03 WIB

CVE-2026-4991

QDOCS Smart School Management System Admission Enquiry enquiry cross site scripting

A vulnerability was detected in QDOCS Smart School Management System up to 7.2. The impacted element is an unknown function of the file /admin/enquiry of the component Admission Enquiry Module. Performing a manipulation of the argument Note results in cross site scripting. The attack is possible to be carried out remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T22:03:43.432Z. Updated 2026-03-30T18:32:32.719Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 01:32 WIB

Official record

HighPublished 28 Mar 2026, 05:03 WIB

CVE-2026-33989

@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem oper…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T22:03:01.801Z. Updated 2026-03-30T15:47:00.925Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:47 WIB

Official record

HighPublished 28 Mar 2026, 05:01 WIB

CVE-2026-33981

Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no passw…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T22:01:13.719Z. Updated 2026-03-30T18:36:23.805Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 01:36 WIB

Official record

HighPublished 28 Mar 2026, 04:32 WIB

CVE-2026-33980

Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries

Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Kusto Query Language) injection vulnerabilities in three MCP to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:32:57.541Z. Updated 2026-03-27T21:56:16.579Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 04:56 WIB

Official record

HighPublished 28 Mar 2026, 04:29 WIB

CVE-2026-33979

Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are silently ignored. In…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:29:19.759Z. Updated 2026-03-31T14:29:43.694Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:29 WIB

Official record

HighPublished 28 Mar 2026, 04:27 WIB

CVE-2026-33955

Notesnook vulnerable to RCE via stored XSS in Note History diff viewer

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using `dangerouslySetInner…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:27:31.554Z. Updated 2026-04-03T13:02:56.898Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 20:02 WIB

Official record

MedPublished 28 Mar 2026, 04:27 WIB

CVE-2026-4990

chatwoot Signup Endpoint login improper authorization

A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup Endpoint. Such manipulation of the argument signupEnabled with the input true leads to improper authorization. The attack can be executed remotely. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:27:18.090Z. Updated 2026-03-31T14:28:07.910Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:28 WIB

Official record

MedPublished 28 Mar 2026, 04:27 WIB

CVE-2026-4988

Open5GS CCA Message smf_s6b denial of service

A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b of the component CCA Message Handler. The manipulation results in denial of service. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is assessed as…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:27:16.379Z. Updated 2026-03-30T17:42:11.269Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 00:42 WIB

Official record

MedPublished 28 Mar 2026, 04:27 WIB

CVE-2026-4985

dloebl CGIF GIF Image cgif.c cgif_addframe integer overflow

A vulnerability was identified in dloebl CGIF up to 0.5.2. This vulnerability affects the function cgif_addframe of the file src/cgif.c of the component GIF Image Handler. The manipulation of the argument width/height leads to integer overflow. The attack may be initiated remotely. The identifier of the patch is b0ba83…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:27:13.537Z. Updated 2026-03-30T15:48:41.448Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:48 WIB

Official record

CritPublished 28 Mar 2026, 04:26 WIB

CVE-2026-33976

Notesnook vulnerable to RCE via stored XSS in Web Clipper rendering

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper preserves attacker-controlled attributes from the source page’s root element a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:26:10.127Z. Updated 2026-04-03T03:55:22.486Z.

CVSS9.7v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record

MedPublished 28 Mar 2026, 04:23 WIB

CVE-2026-33954

LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility, but the web link detail page renders notes without applying…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:23:30.148Z. Updated 2026-03-27T21:57:41.206Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 04:57 WIB

Official record

HighPublished 28 Mar 2026, 04:22 WIB

CVE-2026-33953

LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce

LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP literals, but still performs server-side requests to internal-only resources when those resources are referenced through an internal hostname. This allows an authenticated user to trigger server-side r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:22:03.963Z. Updated 2026-03-30T15:39:58.365Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated30 Mar 2026, 22:39 WIB

Official record

HighPublished 28 Mar 2026, 04:21 WIB

CVE-2026-27309

Substance3D - Stager | Use After Free (CWE-416)

Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:21:37.004Z. Updated 2026-08-27T22:09:21.945Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 05:09 WIB

Official record

HighPublished 28 Mar 2026, 04:20 WIB

CVE-2026-33946

MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:20:07.900Z. Updated 2026-03-30T18:42:43.387Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 01:42 WIB

Official record

HighPublished 28 Mar 2026, 04:19 WIB

CVE-2019-25652

UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM

UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification vulnerability that allows adjacent network attackers to conduct man-in-the-middle attacks by presenting a false SSL certificate during SMTP connections. Attackers can intercept SMTP traffic and obtain…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:19:26.490Z. Updated 2026-07-15T01:24:06.306Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

HighPublished 28 Mar 2026, 04:17 WIB

CVE-2026-34226

Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })` is used. This can leak cookies from origin A to des…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:17:24.777Z. Updated 2026-07-15T01:04:37.919Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:04 WIB

Official record

CritPublished 28 Mar 2026, 04:16 WIB

CVE-2019-25651

Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control

Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attacke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T21:16:30.611Z. Updated 2026-07-15T01:24:05.621Z.

CVSS9v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record