Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 641–660 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 27 Mar 2026, 21:43 WIB

CVE-2026-5025

Langflow - Application Logs Exposed to All Authenticated Users

The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get_current_active_user') without any privilege checks (e.g., 'is_superuser').

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:43:00.533Z. Updated 2026-03-27T15:38:54.925Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 22:38 WIB

Official record

MedPublished 27 Mar 2026, 21:35 WIB

CVE-2026-5010

Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu

A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user data, such as sessio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 641 to 660 of 6236.First page Next page

Published 2026-03-27T14:35:06.783Z. Updated 2026-03-27T15:08:30.583Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 22:08 WIB

Official record

MedPublished 27 Mar 2026, 21:34 WIB

CVE-2026-5022

Langflow - Missing Authorization on download_image Endpoint

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:34:14.046Z. Updated 2026-03-27T15:10:20.925Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 22:10 WIB

Official record

MedPublished 27 Mar 2026, 21:31 WIB

CVE-2026-33766

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:31:06.272Z. Updated 2026-03-27T14:45:06.774Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 21:45 WIB

Official record

MedPublished 27 Mar 2026, 21:29 WIB

CVE-2026-33764

AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's `save.json.php` endpoint loads AI response objects using an attacker-controlled `$_REQUEST['id']` parameter without validating that the AI response belongs to the specified video. An authenticated user with AI permission…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:29:53.559Z. Updated 2026-03-27T19:58:05.730Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 02:58 WIB

Official record

MedPublished 27 Mar 2026, 21:28 WIB

CVE-2026-27879

Query resampling can cause unbounded memory allocations

A resample query can be used to trigger out-of-memory crashes in Grafana.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:28:56.133Z. Updated 2026-08-27T17:22:24.918Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:22 WIB

Official record

MedPublished 27 Mar 2026, 21:26 WIB

CVE-2026-28375

Grafana Testdata datasource can issue unbounded memory allocations

A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:26:19.270Z. Updated 2026-08-27T17:22:22.927Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:22 WIB

Official record

MedPublished 27 Mar 2026, 21:25 WIB

CVE-2026-33763

AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:25:12.794Z. Updated 2026-03-30T12:06:27.809Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated30 Mar 2026, 19:06 WIB

Official record

CritPublished 27 Mar 2026, 21:24 WIB

CVE-2026-27876

RCE on Grafana via sqlExpressions

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:24:36.771Z. Updated 2026-08-27T17:22:25.648Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:22 WIB

Official record

MedPublished 27 Mar 2026, 21:24 WIB

CVE-2026-33761

AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings

WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentication check, while every other endpoint in the same plugin directories (`add.json.php`, `delete.json.php`, `index.php`) requires `User::isAdmin()`. An unauthentic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:24:08.051Z. Updated 2026-03-27T17:22:49.884Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 00:22 WIB

Official record

MedPublished 27 Mar 2026, 21:18 WIB

CVE-2026-33759

AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidd…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:18:48.810Z. Updated 2026-03-27T14:45:56.632Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 21:45 WIB

Official record

CritPublished 27 Mar 2026, 21:14 WIB

CVE-2026-1496

Coverity CLI Authentication Bypass

Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or guesses a valid username, can use this in a specially crafted HTTP reques…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:14:01.871Z. Updated 2026-03-27T14:36:04.188Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 21:36 WIB

Official record

HighPublished 27 Mar 2026, 21:13 WIB

CVE-2026-4984

Botpress - Credential Disclosure via Twilio Webhook Handler

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs ('MediaUrlN' parameters) using HTTP requests that include the integration's Twilio credentials in the 'Authorization' header. An attacker ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:13:51.003Z. Updated 2026-05-10T13:57:42.981Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated10 May 2026, 20:57 WIB

Official record

MedPublished 27 Mar 2026, 21:13 WIB

CVE-2026-4954

mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection

A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:13:38.633Z. Updated 2026-03-27T22:16:13.177Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 05:16 WIB

Official record

MedPublished 27 Mar 2026, 21:13 WIB

CVE-2026-4953

mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery

A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/mingsoft/cms/action/BaseAction.java of the component Editor Endpoint. Executing a manipulation of the argument catchimage can lead to server-side request forgery. It is possible to launch the attack r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:13:36.216Z. Updated 2026-03-30T12:05:18.706Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 19:05 WIB

Official record

CritPublished 27 Mar 2026, 21:12 WIB

CVE-2026-33758

OpenBao has Reflected XSS in its OIDC authentication error message

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:12:33.941Z. Updated 2026-07-15T01:06:07.192Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:06 WIB

Official record

HighPublished 27 Mar 2026, 21:12 WIB

CVE-2026-27880

OpenFeature evaluation API reads input data with no bounds

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:12:20.075Z. Updated 2026-08-27T17:22:49.478Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:22 WIB

Official record

CritPublished 27 Mar 2026, 21:10 WIB

CVE-2026-33757

OpenBao lacks user confirmation for OIDC direct callback mode

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by having the v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:10:58.639Z. Updated 2026-07-15T01:06:09.550Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:06 WIB

Official record

HighPublished 27 Mar 2026, 21:08 WIB

CVE-2024-11604

Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows authenticated local users to obtain sensitive information via access to log files. This issue affects IDM SCIM Driver: 1.0.0.0000 through 1.0.1.0300 and 1.1.0.0…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:08:59.958Z. Updated 2026-03-27T14:49:21.826Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 21:49 WIB

Official record

HighPublished 27 Mar 2026, 21:08 WIB

CVE-2026-33755

Authenticated SQL Injection in Contact/query addressBookIds filter

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Injection vulnerability in the JMAP `Contact/query` endpoint allows any authenticated user with basic addressbook access to extract arbitrary data from the database — …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:08:38.685Z. Updated 2026-03-27T17:23:30.752Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 00:23 WIB

Official record