Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6461–6480 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 16 Aug 2026, 04:44 WIB

CVE-2026-73045

SiYuan before 3.7.4 Brute-Force via authFilePublishAccess

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain acce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T21:44:49.843Z. Updated 2026-08-18T02:21:11.852Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 09:21 WIB

Official record

CritPublished 16 Aug 2026, 04:44 WIB

CVE-2026-73044

SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 6461 to 6480 of 12259.First page Next page

Published 2026-08-15T21:44:49.179Z. Updated 2026-08-17T18:35:00.912Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:35 WIB

Official record

CritPublished 16 Aug 2026, 04:44 WIB

CVE-2026-73043

SiYuan before v3.7.4 Remote Code Execution via Template Calculation

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in the desktop client ren…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T21:44:48.494Z. Updated 2026-08-17T15:48:48.974Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:48 WIB

Official record

CritPublished 16 Aug 2026, 04:44 WIB

CVE-2026-73042

SiYuan before v3.7.4 Remote Code Execution via Menu Metadata

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T21:44:47.828Z. Updated 2026-08-17T16:06:43.089Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:06 WIB

Official record

CritPublished 16 Aug 2026, 04:44 WIB

CVE-2026-73041

SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T21:44:47.192Z. Updated 2026-08-17T17:36:44.058Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 00:36 WIB

Official record

CritPublished 16 Aug 2026, 04:39 WIB

CVE-2026-74764

Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter. An attacker able to submit a specially crafted TAR archi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T21:39:09.862Z. Updated 2026-08-17T19:40:57.773Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:40 WIB

Official record

MedPublished 16 Aug 2026, 02:00 WIB

CVE-2026-19906

pkp pkp-lib API Key Generation APIProfileForm.php setData entropy

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may be performed from remote…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T19:00:10.115Z. Updated 2026-08-17T17:39:52.698Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 00:39 WIB

Official record

MedPublished 16 Aug 2026, 01:45 WIB

CVE-2026-19905

Jinher OA attendance_out_approve.aspx sql injection

A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This manipulation of the argument httpOID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and cou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T18:45:07.525Z. Updated 2026-08-19T15:42:47.162Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 22:42 WIB

Official record

CritPublished 16 Aug 2026, 01:25 WIB

CVE-2026-18855

Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T18:25:57.238Z. Updated 2026-08-17T16:06:52.294Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:06 WIB

Official record

MedPublished 16 Aug 2026, 01:00 WIB

CVE-2026-19904

SourceCodester Online Book Store System System Settings index.php site_settings cross site scripting

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been made publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T18:00:08.670Z. Updated 2026-08-18T13:38:33.685Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:38 WIB

Official record

MedPublished 16 Aug 2026, 00:45 WIB

CVE-2026-19903

SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access

A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has been disclosed to the publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T17:45:07.886Z. Updated 2026-08-17T15:45:33.120Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:45 WIB

Official record

CritPublished 16 Aug 2026, 00:25 WIB

CVE-2026-19598

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T17:25:26.723Z. Updated 2026-08-17T15:49:27.097Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:49 WIB

Official record

CritPublished 16 Aug 2026, 00:15 WIB

CVE-2026-19901

LB-LINK X-PRO easycwmp hard-coded credentials

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T17:15:07.700Z. Updated 2026-08-18T02:19:59.132Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 09:19 WIB

Official record

CritPublished 15 Aug 2026, 23:45 WIB

CVE-2026-19900

LB-LINK X-PRO shadow hard-coded credentials

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T16:45:07.432Z. Updated 2026-08-17T17:40:52.037Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 00:40 WIB

Official record

MedPublished 15 Aug 2026, 23:30 WIB

CVE-2026-19899

SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /edit_teacher.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T16:30:09.072Z. Updated 2026-08-19T15:51:20.814Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 22:51 WIB

Official record

MedPublished 15 Aug 2026, 22:45 WIB

CVE-2026-19898

VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possible to be carried out rem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T15:45:10.515Z. Updated 2026-08-18T13:38:42.090Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:38 WIB

Official record

MedPublished 15 Aug 2026, 22:30 WIB

CVE-2026-19897

mangroup dtale Login Endpoint auth.py login excessive authentication

A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T15:30:08.386Z. Updated 2026-08-17T15:50:10.566Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:50 WIB

Official record

MedPublished 15 Aug 2026, 21:15 WIB

CVE-2026-19896

mangroup dtale Flask Session Cookie app.py build_secret_key random values

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. I…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T14:15:08.291Z. Updated 2026-08-18T02:19:15.776Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 09:19 WIB

Official record

MedPublished 15 Aug 2026, 20:45 WIB

CVE-2026-18165

@fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the browser that began the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T13:45:51.666Z. Updated 2026-08-17T19:41:55.649Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:41 WIB

Official record

HighPublished 15 Aug 2026, 20:36 WIB

CVE-2026-19474

@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T13:36:13.037Z. Updated 2026-08-17T19:43:19.646Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:43 WIB

Official record