Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,616 published records · 20 KEV · 4,616 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,616 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3317.2%
High1,42031%
Med1,98843%
Low2104.5%
None360.78%
Legacy00.00%
Unscored63114%

Matching records by UTC month

Feb 264,616

Signal coverage

KEV-listed: 20
With a forecast: 4,616
Unknown date: 0
Unscored severity: 631

Share of cohort: KEV 0.43% · forecast 100% · unscored 14%.

Showing 601–620 of 4,616By severity band: Critical · 9.0–10.0 331, High · 7.0–8.9 1,420, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 210, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 631

HighPublished 25 Feb 2026, 08:09 WIB

CVE-2025-67752

OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper (`oeHttp`/`oeHttpRequest`) disables SSL/TLS certificate verification by default (`verify: false`), making all external HTTPS connections vulnerable to man-in-the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T01:09:20.946Z. Updated 2026-02-27T17:30:42.203Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:30 WIB

Official record

MedPublished 25 Feb 2026, 07:32 WIB

CVE-2026-3137

CodeAstro Food Ordering System food_ordering.exe stack-based overflow

A security vulnerability has been detected in CodeAstro Food Ordering System 1.0. This affects an unknown function of the file food_ordering.exe. Such manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 601 to 620 of 4616.First page Next page

Published 2026-02-25T00:32:07.501Z. Updated 2026-02-27T17:31:16.374Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:31 WIB

Official record

HighPublished 25 Feb 2026, 07:31 WIB

CVE-2025-67491

OpenEMR has Stored XSS in ub04 helper

OpenEMR is a free and open source electronic health records and medical practice management application. Versions 5.0.0.5 through 7.0.3.4 have a stored cross-site scripting vulnerability in the ub04 helper of the billing interface. The variable `$data` is passed in a click event handler enclosed in single quotes withou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T00:31:11.369Z. Updated 2026-02-27T17:32:18.289Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 00:32 WIB

Official record

HighPublished 25 Feb 2026, 07:27 WIB

CVE-2026-27598

Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory

Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the `CreateNewDAG` API endpoint (`POST /api/v1/dags`) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T00:27:40.654Z. Updated 2026-02-26T21:02:19.359Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 04:02 WIB

Official record

MedPublished 25 Feb 2026, 07:02 WIB

CVE-2026-3135

itsourcecode News Portal Project add-category.php sql injection

A weakness has been identified in itsourcecode News Portal Project 1.0. The impacted element is an unknown function of the file /admin/add-category.php. This manipulation of the argument Category causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T00:02:08.161Z. Updated 2026-02-26T20:57:10.132Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:57 WIB

Official record

UnscoredPublished 25 Feb 2026, 07:00 WIB

CVE-2025-69771

CVE-2025-69771

Cross-Site Scripting (XSS) vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14.0 allows attackers to execute arbitrary JavaScript in the context of the active streaming platform via a crafted .srt subtitle file. Because the script executes within the same-site context, it can b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T00:00:00.000Z. Updated 2026-03-20T18:27:37.557Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2026, 01:27 WIB

Official record

UnscoredPublished 25 Feb 2026, 07:00 WIB

CVE-2026-26717

CVE-2026-26717

An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepanci…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T00:00:00.000Z. Updated 2026-02-26T19:11:04.934Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:11 WIB

Official record

MedPublished 25 Feb 2026, 06:32 WIB

CVE-2026-3134

itsourcecode News Portal Project edit-category.php sql injection

A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-category.php. The manipulation of the argument Category results in sql injection. The attack may be performed from remote. The exploit has been released to the publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T23:32:11.537Z. Updated 2026-02-27T18:54:52.791Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:54 WIB

Official record

MedPublished 25 Feb 2026, 06:32 WIB

CVE-2026-3133

itsourcecode Document Management System Login loging.php sql injection

A vulnerability has been found in itsourcecode Document Management System 1.0. This issue affects some unknown processing of the file /loging.php of the component Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T23:32:08.553Z. Updated 2026-02-27T18:54:25.889Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 01:54 WIB

Official record

MedPublished 25 Feb 2026, 05:05 WIB

CVE-2026-26351

GetSimpleCMS-CE < 3.3.22 Stored XSS via components.php

GetSimpleCMS Community Edition (CE) versions prior to 3.3.22 (3.3.16 tested) contains a stored cross-site scripting (XSS) vulnerability in the Theme to Components functionality within components.php. User-supplied input provided to the "slug" field of a component is stored without proper output encoding. While other fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T22:05:54.420Z. Updated 2026-07-14T18:39:32.725Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:39 WIB

Official record

MedPublished 25 Feb 2026, 04:46 WIB

CVE-2026-27117

bit7z has a path traversal vulnerability

bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.11, a path traversal vulnerability ("Zip Slip") exists in bit7z's archive extraction functionality. The library does not adequately validate file paths contained in archive entries, allowing files …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T21:46:12.714Z. Updated 2026-02-26T21:33:40.678Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 04:33 WIB

Official record

CritPublished 25 Feb 2026, 04:38 WIB

CVE-2026-27593

Statamic is vulnerable to account takeover via password reset link injection

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T21:38:17.354Z. Updated 2026-02-27T20:56:07.561Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Feb 2026, 03:56 WIB

Official record

MedPublished 25 Feb 2026, 04:31 WIB

CVE-2026-27572

Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T21:31:50.186Z. Updated 2026-02-27T20:55:29.879Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 03:55 WIB

Official record

MedPublished 25 Feb 2026, 04:23 WIB

CVE-2026-27204

Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susceptible to guest-controlled resource exhaustion on the host. Wasmtime did not appropriately place limits on resource allocations requested by the guests. This se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T21:23:47.007Z. Updated 2026-02-27T20:54:48.839Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Feb 2026, 03:54 WIB

Official record

MedPublished 25 Feb 2026, 04:15 WIB

CVE-2026-27195

Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the `component-model-async` feature became the default, which brought with it a new implementation of `[Typed]Func::call_async` which made it capable of calling async-typed guest export functions. However, that implementation had a bug leading to a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T21:15:20.366Z. Updated 2026-02-24T21:36:54.122Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Feb 2026, 04:36 WIB

Official record

HighPublished 25 Feb 2026, 04:11 WIB

CVE-2026-25899

Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation

Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T21:11:17.804Z. Updated 2026-02-24T21:37:33.970Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated25 Feb 2026, 04:37 WIB

Official record

HighPublished 25 Feb 2026, 04:08 WIB

CVE-2026-25891

Fiber has an Arbitrary File Read in Static Middleware on Windows

Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 vers…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T21:08:48.675Z. Updated 2026-02-24T21:39:11.118Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated25 Feb 2026, 04:39 WIB

Official record

MedPublished 25 Feb 2026, 04:05 WIB

CVE-2026-25882

Fiber has a Denial of Service Vulnerability via Route Parameter Overflow

Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined wit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T21:05:28.211Z. Updated 2026-02-24T21:39:51.170Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated25 Feb 2026, 04:39 WIB

Official record

CritPublished 25 Feb 2026, 03:56 WIB

CVE-2026-22553

InSAT MasterSCADA BUK-TS OS Command Injection

All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T20:56:14.099Z. Updated 2026-02-26T19:39:01.753Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:39 WIB

Official record

CritPublished 25 Feb 2026, 03:53 WIB

CVE-2026-21410

InSAT MasterSCADA BUK-TS SQL Injection

InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-24T20:53:55.150Z. Updated 2026-02-26T19:41:40.457Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:41 WIB

Official record