Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 5361–5380 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 03 Apr 2026, 01:27 WIB

CVE-2023-7342

Belden HiSecOS Web Server Privilege Escalation

HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authenticated users with operator or auditor roles to escalate privileges to the administrator role by sending specially crafted packets to the web server. Attackers can exploit this flaw to gain full administ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:27:15.226Z. Updated 2026-10-01T15:19:45.278Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:25 WIB

CVE-2025-43257

CVE-2025-43257

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.6. An app may be able to break out of its sandbox.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:25:34.707Z. Updated 2026-04-02T19:38:15.670Z.

Showing 5361 to 5380 of 5813.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 02:38 WIB

Official record

MedPublished 03 Apr 2026, 01:25 WIB

CVE-2026-34426

OpenClaw - Approval Bypass via Environment Variable Normalization

OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment variables into execution without approval system validation. Attackers can exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:25:14.022Z. Updated 2026-04-03T16:17:00.360Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 23:17 WIB

Official record

HighPublished 03 Apr 2026, 01:23 WIB

CVE-2026-34735

Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController`

The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. In version 1.2.0 and prior, the quickUpload() endpoint validates uploaded files by checking their MIME type (via PHP's finfo, which inspects file contents) but constructs the stored filename using the client-supplied file ext…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:23:26.441Z. Updated 2026-04-02T19:14:04.735Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 02:14 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:22 WIB

CVE-2024-40849

CVE-2024-40849

A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of its sandbox.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:22:35.062Z. Updated 2026-04-02T19:49:19.309Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 02:49 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:21 WIB

CVE-2024-44303

CVE-2024-44303

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1. A malicious application may be able to modify protected parts of the file system.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:21:49.890Z. Updated 2026-04-02T19:55:04.427Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 02:55 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:21 WIB

CVE-2025-43210

CVE-2025-43210

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted media file may lead to unexpected app terminat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:21:26.395Z. Updated 2026-04-02T19:42:30.658Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 02:42 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:21 WIB

CVE-2024-44250

CVE-2024-44250

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:21:22.968Z. Updated 2026-04-03T03:55:50.667Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:20 WIB

CVE-2024-40858

CVE-2024-40858

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user consent.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:20:41.441Z. Updated 2026-04-02T19:52:40.158Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 02:52 WIB

Official record

MedPublished 03 Apr 2026, 01:15 WIB

CVE-2026-5417

Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery

A vulnerability was determined in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of the file backend/apps/db/es_engine.py of the component Elasticsearch Handler. This manipulation of the argument address causes server-side request forgery. The attack may be initiated remotely. The expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:15:11.883Z. Updated 2026-04-03T20:00:17.177Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated04 Apr 2026, 03:00 WIB

Official record

MedPublished 03 Apr 2026, 01:15 WIB

CVE-2026-34425

OpenClaw - Shell-Bleed Protection Preflight Validation Bypass

OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content by using piped or complex command forms that the parser fails to recognize. Attackers can craft commands such as piped execution, command substi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:15:06.544Z. Updated 2026-04-03T13:00:31.471Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 20:00 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:14 WIB

CVE-2025-43264

CVE-2025-43264

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process memory.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:14:49.072Z. Updated 2026-04-03T03:55:52.859Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:13 WIB

CVE-2024-44286

CVE-2024-44286

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access can input keyboard events to apps running on a locked device.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:13:22.295Z. Updated 2026-04-02T19:57:15.594Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 02:57 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:11 WIB

CVE-2024-44219

CVE-2024-44219

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be able to access private information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:11:55.580Z. Updated 2026-04-02T19:59:30.524Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 02:59 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:10 WIB

CVE-2025-43202

CVE-2025-43202

This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6. Processing a file may lead to memory corruption.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:10:46.701Z. Updated 2026-04-03T13:00:53.495Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 20:00 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:09 WIB

CVE-2025-43238

CVE-2025-43238

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause unexpected system termination.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:09:41.749Z. Updated 2026-04-02T18:54:57.007Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:54 WIB

Official record

MedPublished 03 Apr 2026, 01:09 WIB

CVE-2026-34730

Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessibl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:09:16.007Z. Updated 2026-04-03T13:01:14.081Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 20:01 WIB

Official record

MedPublished 03 Apr 2026, 01:07 WIB

CVE-2026-34726

Copier `_subdirectory` allows template root escape via parent-directory traversal

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:07:35.517Z. Updated 2026-04-03T16:16:03.275Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 23:16 WIB

Official record

UnscoredPublished 03 Apr 2026, 01:07 WIB

CVE-2025-43219

CVE-2025-43219

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process memory.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:07:26.144Z. Updated 2026-04-03T03:55:58.137Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 10:55 WIB

Official record

HighPublished 03 Apr 2026, 01:04 WIB

CVE-2026-34581

goshs has Auth Bypass via Share Token

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-02T18:04:35.217Z. Updated 2026-04-03T17:01:54.432Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated04 Apr 2026, 00:01 WIB

Official record