Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 19 KEV · 15,829 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 19
With a forecast: 15,829
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 98% · unscored 22%.

Showing 521–540 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 29 Oct 2026, 01:23 WIB

CVE-2026-118257

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the val…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:23:49.400Z. Updated 2026-10-28T18:23:49.400Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:23 WIB

Official record

LowPublished 29 Oct 2026, 01:20 WIB

CVE-2026-118256

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() process…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 521 to 540 of 16156.First page Next page

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:20:14.644Z. Updated 2026-10-28T18:20:14.644Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:20 WIB

Official record

HighPublished 29 Oct 2026, 01:17 WIB

CVE-2026-118255

Highcharts Grid: javascript: URL in credits.href runs script on click

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the host…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:17:14.543Z. Updated 2026-10-28T18:17:14.543Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:17 WIB

Official record

HighPublished 29 Oct 2026, 01:13 WIB

CVE-2026-118254

Highcharts Grid: pagination language options are parsed as HTML

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:13:20.084Z. Updated 2026-10-28T18:13:20.084Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:13 WIB

Official record

HighPublished 29 Oct 2026, 01:11 WIB

CVE-2026-118253

Highcharts Dashboards: fullscreen labels are parsed as HTML

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:11:03.809Z. Updated 2026-10-28T18:11:03.809Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:11 WIB

Official record

HighPublished 29 Oct 2026, 01:08 WIB

CVE-2026-118252

Highcharts Dashboards: sidebar component labels are parsed as HTML

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing event handlers, which ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:08:33.407Z. Updated 2026-10-28T18:08:33.407Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:08 WIB

Official record

UnscoredPublished 29 Oct 2026, 01:04 WIB

CVE-2026-106484

CVE-2026-106484

Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:04:06.666Z. Updated 2026-10-29T13:22:37.480Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:22 WIB

Official record

HighPublished 29 Oct 2026, 01:02 WIB

CVE-2026-118251

Highcharts: javascript: URL in credits.href runs script on click

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:02:46.576Z. Updated 2026-10-28T18:02:46.576Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:02 WIB

Official record

HighPublished 29 Oct 2026, 00:59 WIB

CVE-2026-118250

Highcharts: dotted series.keys paths write to Object.prototype

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:59:48.828Z. Updated 2026-10-28T17:59:48.828Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:59 WIB

Official record

HighPublished 29 Oct 2026, 00:57 WIB

CVE-2026-118249

Highcharts: series column construction writes to Object.prototype

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the O…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:57:18.323Z. Updated 2026-10-28T17:57:18.323Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:57 WIB

Official record

MedPublished 29 Oct 2026, 00:55 WIB

CVE-2026-118248

Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit write…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:55:47.520Z. Updated 2026-10-28T17:55:47.520Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:55 WIB

Official record

MedPublished 29 Oct 2026, 00:50 WIB

CVE-2026-118247

Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ or constructor. DataTable.setCell, including Dashboards connector write-back and G…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:50:59.526Z. Updated 2026-10-28T17:50:59.526Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:50 WIB

Official record

HighPublished 29 Oct 2026, 00:47 WIB

CVE-2026-118246

Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadcr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:47:18.817Z. Updated 2026-10-28T17:47:18.817Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:47 WIB

Official record

HighPublished 29 Oct 2026, 00:44 WIB

CVE-2026-118245

Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:44:51.571Z. Updated 2026-10-28T17:44:51.571Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:44 WIB

Official record

HighPublished 29 Oct 2026, 00:36 WIB

CVE-2026-118244

Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print

Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:36:43.768Z. Updated 2026-10-28T17:36:43.768Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:36 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:34 WIB

CVE-2026-116273

MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion

MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has. Version 5.521 sets max_p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:34:44.660Z. Updated 2026-10-28T17:34:44.660Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:34 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:34 WIB

CVE-2026-116272

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundary((c))="A" or boundary(\))="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:34:25.862Z. Updated 2026-10-28T17:34:25.862Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:34 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:34 WIB

CVE-2026-116271

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file na…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:34:06.757Z. Updated 2026-10-28T17:34:06.757Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:34 WIB

Official record

UnscoredPublished 29 Oct 2026, 00:33 WIB

CVE-2026-116270

MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords

MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords. For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:33:48.187Z. Updated 2026-10-28T17:33:48.187Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:33 WIB

Official record

MedPublished 29 Oct 2026, 00:33 WIB

CVE-2026-118243

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:33:31.422Z. Updated 2026-10-28T17:33:31.422Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:33 WIB

Official record