Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 681–700 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 30 Sep 2026, 04:29 WIB

CVE-2026-71972

U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder

U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T21:29:20.688Z. Updated 2026-09-30T14:10:40.135Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:10 WIB

Official record

HighPublished 30 Sep 2026, 04:29 WIB

CVE-2026-71971

U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly

U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 681 to 700 of 14934.First page Next page

Published 2026-09-29T21:29:20.055Z. Updated 2026-09-30T14:03:55.512Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:03 WIB

Official record

HighPublished 30 Sep 2026, 04:28 WIB

CVE-2026-72510

Toptech TMS7 and TopHAT SQL Injection

The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T21:28:26.762Z. Updated 2026-09-30T15:28:15.314Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

CritPublished 30 Sep 2026, 04:26 WIB

CVE-2026-70356

Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T21:26:22.603Z. Updated 2026-09-30T15:28:15.470Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

CritPublished 30 Sep 2026, 04:23 WIB

CVE-2026-71379

Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties

The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T21:23:25.412Z. Updated 2026-09-30T15:28:15.620Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

HighPublished 30 Sep 2026, 04:04 WIB

CVE-2026-91191

Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed. Separately, the publicly …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T21:04:52.546Z. Updated 2026-09-30T15:28:15.769Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

HighPublished 30 Sep 2026, 04:02 WIB

CVE-2026-84409

Lantronix G520 Series Cellular Gateway Cross-site Scripting

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update information inserts that…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T21:02:09.711Z. Updated 2026-09-30T15:28:15.903Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

MedPublished 30 Sep 2026, 03:58 WIB

CVE-2026-102938

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:58:20.696Z. Updated 2026-09-30T19:53:20.817Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:53 WIB

Official record

HighPublished 30 Sep 2026, 03:56 WIB

CVE-2026-102937

virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can inc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:56:13.998Z. Updated 2026-10-02T12:28:15.446Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:28 WIB

Official record

HighPublished 30 Sep 2026, 03:55 WIB

CVE-2026-93853

Barman snapshot backup deletion trusts unverified backup catalog metadata

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the backup.info file and pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:55:51.959Z. Updated 2026-09-30T15:28:16.037Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

HighPublished 30 Sep 2026, 03:53 WIB

CVE-2026-102930

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLE_SHA256 verificati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:53:36.018Z. Updated 2026-09-30T14:02:24.390Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 21:02 WIB

Official record

HighPublished 30 Sep 2026, 03:50 WIB

CVE-2026-102925

virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:50:57.199Z. Updated 2026-09-30T19:25:16.653Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:25 WIB

Official record

MedPublished 30 Sep 2026, 03:50 WIB

CVE-2026-81842

Library panel can be moved into a folder without library panel create permission

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authori…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:50:01.257Z. Updated 2026-09-30T15:28:16.203Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

MedPublished 30 Sep 2026, 03:47 WIB

CVE-2026-102904

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installation but passes uninstall …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:47:43.290Z. Updated 2026-09-30T20:07:08.531Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:07 WIB

Official record

CritPublished 30 Sep 2026, 03:42 WIB

CVE-2026-96587

Use of Hard-coded Credentials in Viidure Dashcam Android Application

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:42:38.270Z. Updated 2026-09-29T21:02:00.222Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 04:02 WIB

Official record

HighPublished 30 Sep 2026, 03:40 WIB

CVE-2026-94204

Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:40:52.681Z. Updated 2026-09-29T21:02:00.018Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 04:02 WIB

Official record

MedPublished 30 Sep 2026, 03:35 WIB

CVE-2026-81841

Paused shared dashboard access tokens still expose data source configuration

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:35:57.152Z. Updated 2026-09-30T13:05:14.107Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:05 WIB

Official record

MedPublished 30 Sep 2026, 03:30 WIB

CVE-2026-102620

Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow

A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 2…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:30:15.183Z. Updated 2026-10-02T12:26:30.155Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:26 WIB

Official record

HighPublished 30 Sep 2026, 03:11 WIB

CVE-2026-102253

iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can perman…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:11:47.089Z. Updated 2026-10-01T15:19:47.164Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

MedPublished 30 Sep 2026, 03:01 WIB

CVE-2026-102879

ClaraVerse through 0.3.1 SSRF Protection Bypass

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download_file and scrape_web agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata endpoints.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T20:01:09.282Z. Updated 2026-09-30T13:46:17.155Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:46 WIB

Official record