Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 521–540 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 29 Aug 2026, 05:31 WIB

CVE-2026-55848

mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/G…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:31:26.705Z. Updated 2026-08-31T14:10:14.891Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:10 WIB

Official record

LowPublished 29 Aug 2026, 05:25 WIB

CVE-2026-55785

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 521 to 540 of 12259.First page Next page

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:25:06.814Z. Updated 2026-08-31T18:53:29.062Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:53 WIB

Official record

HighPublished 29 Aug 2026, 05:23 WIB

CVE-2026-55784

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:23:41.923Z. Updated 2026-09-01T02:04:02.754Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 09:04 WIB

Official record

MedPublished 29 Aug 2026, 05:18 WIB

CVE-2026-55779

Silverstripe Versioned: XSS in archive admin restore

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CAST_HTML and inserts $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty[…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:18:57.661Z. Updated 2026-08-31T18:23:24.962Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:23 WIB

Official record

MedPublished 29 Aug 2026, 05:14 WIB

CVE-2026-55867

Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERS_TOKENREMOVE permission again…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:14:35.743Z. Updated 2026-08-31T18:38:29.854Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:38 WIB

Official record

HighPublished 29 Aug 2026, 05:11 WIB

CVE-2026-55841

Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:11:08.747Z. Updated 2026-09-01T02:03:04.137Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 09:03 WIB

Official record

HighPublished 29 Aug 2026, 05:08 WIB

CVE-2026-55764

Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation performed meta.Circulation += amount before evalua…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:08:27.196Z. Updated 2026-08-31T18:24:52.989Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:24 WIB

Official record

MedPublished 29 Aug 2026, 05:06 WIB

CVE-2026-55855

MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 client c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:06:42.810Z. Updated 2026-08-31T14:01:23.908Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:01 WIB

Official record

MedPublished 29 Aug 2026, 05:03 WIB

CVE-2026-55854

MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-passwo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:03:30.200Z. Updated 2026-08-31T18:53:32.987Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:53 WIB

Official record

LowPublished 29 Aug 2026, 04:45 WIB

CVE-2026-22056

CVE-2026-22056 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T21:45:53.370Z. Updated 2026-08-31T18:31:31.260Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:31 WIB

Official record

MedPublished 29 Aug 2026, 04:11 WIB

CVE-2026-82018

IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File

IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB's fail-open signat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T21:11:24.911Z. Updated 2026-10-01T15:21:40.808Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

HighPublished 29 Aug 2026, 04:09 WIB

CVE-2026-82017

IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject mali…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T21:09:01.253Z. Updated 2026-10-01T15:21:40.174Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

MedPublished 29 Aug 2026, 03:54 WIB

CVE-2026-3686

Vulnerabilities exists in IBM Cloud Pak for Data System

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T20:54:02.208Z. Updated 2026-08-31T18:42:09.294Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:42 WIB

Official record

CritPublished 29 Aug 2026, 03:53 WIB

CVE-2026-3627

Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T20:53:37.759Z. Updated 2026-09-01T14:45:38.575Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:45 WIB

Official record

CritPublished 29 Aug 2026, 03:53 WIB

CVE-2026-19295

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T20:53:00.278Z. Updated 2026-09-01T03:56:11.091Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 10:56 WIB

Official record

MedPublished 29 Aug 2026, 03:52 WIB

CVE-2026-19294

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T20:52:38.719Z. Updated 2026-08-31T18:32:00.177Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:32 WIB

Official record

CritPublished 29 Aug 2026, 03:52 WIB

CVE-2026-19286

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T20:52:24.166Z. Updated 2026-09-01T03:56:12.249Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 10:56 WIB

Official record

HighPublished 29 Aug 2026, 03:52 WIB

CVE-2026-18904

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T20:52:08.372Z. Updated 2026-08-31T18:44:55.317Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:44 WIB

Official record

HighPublished 29 Aug 2026, 03:51 WIB

CVE-2026-18899

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T20:51:48.083Z. Updated 2026-09-01T01:59:42.374Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 08:59 WIB

Official record

HighPublished 29 Aug 2026, 03:51 WIB

CVE-2026-18891

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T20:51:27.834Z. Updated 2026-08-31T13:52:41.780Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 20:52 WIB

Official record