Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 601–620 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 28 Mar 2026, 01:22 WIB

CVE-2026-26060

Fleet: Password reset tokens remain valid after password change for 24 hours

Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain valid after a user changes their password. As a result, a stale password reset token could be reused to reset the account password even aft…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T18:22:43.244Z. Updated 2026-03-27T19:32:38.862Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 02:32 WIB

Official record

HighPublished 28 Mar 2026, 01:17 WIB

CVE-2026-34375

AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST['plugin']` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework's input filt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 601 to 620 of 6236.First page Next page

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T18:17:32.604Z. Updated 2026-03-31T13:36:50.491Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 20:36 WIB

Official record

CritPublished 28 Mar 2026, 01:16 WIB

CVE-2026-34374

AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` method constructs a SQL query by interpolating a stream key directly into the query string without parameterization. This method is called as a fallback from `LiveTransmition::keyExists()` when the initi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T18:16:22.155Z. Updated 2026-03-27T19:33:12.013Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 02:33 WIB

Official record

MedPublished 28 Mar 2026, 01:16 WIB

CVE-2025-15612

Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE

Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T18:16:11.058Z. Updated 2026-07-28T01:47:56.171Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:47 WIB

Official record

MedPublished 28 Mar 2026, 01:13 WIB

CVE-2026-34369

AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_file` and `get_api_video` API endpoints in AVideo return full video playback sources (direct MP4 URLs, HLS manifests) for password-protected videos without verifying the video password. While the normal web playback f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T18:13:23.534Z. Updated 2026-03-30T19:03:08.076Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 02:03 WIB

Official record

MedPublished 28 Mar 2026, 01:12 WIB

CVE-2026-34368

AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance — all …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T18:12:18.760Z. Updated 2026-03-30T19:03:46.321Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 02:03 WIB

Official record

MedPublished 28 Mar 2026, 01:11 WIB

CVE-2026-34364

AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `categories.json.php` endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path (no `?user=` parameter), user group filtering is entirely skipped, e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T18:11:05.866Z. Updated 2026-03-27T19:56:56.507Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 02:56 WIB

Official record

HighPublished 28 Mar 2026, 01:04 WIB

CVE-2025-15617

Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T18:04:13.691Z. Updated 2026-05-12T20:46:38.272Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated13 May 2026, 03:46 WIB

Official record

MedPublished 28 Mar 2026, 00:41 WIB

CVE-2026-4968

SourceCodester Diary App diary.php cross-site request forgery

A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can lead to cross-site request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T17:41:52.979Z. Updated 2026-03-27T22:17:15.085Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 05:17 WIB

Official record

MedPublished 28 Mar 2026, 00:41 WIB

CVE-2026-4966

itsourcecode Free Hotel Reservation System index.php sql injection

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. Impacted is an unknown function of the file /admin/mod_room/index.php?view=edit. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T17:41:49.607Z. Updated 2026-03-27T22:08:05.053Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 05:08 WIB

Official record

MedPublished 28 Mar 2026, 00:41 WIB

CVE-2026-4965

letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection

A vulnerability was detected in letta-ai letta 0.16.4. This issue affects the function resolve_type of the file letta/functions/ast_parsers.py of the component Incomplete Fix CVE-2025-6101. Performing a manipulation results in improper neutralization of directives in dynamically evaluated code. The attack can be initia…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T17:41:46.743Z. Updated 2026-03-27T22:07:55.514Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 05:07 WIB

Official record

MedPublished 28 Mar 2026, 00:05 WIB

CVE-2026-4964

letta-ai letta File URL message_helper.py _convert_message_create_to_message server-side request forgery

A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function _convert_message_create_to_message of the file letta/helpers/message_helper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request forgery. It is possib…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T17:05:22.689Z. Updated 2026-03-31T15:11:01.435Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 22:11 WIB

Official record

MedPublished 28 Mar 2026, 00:05 WIB

CVE-2026-4963

huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection

A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation causes code injection. It is possible to initiate the attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T17:05:20.096Z. Updated 2026-03-31T13:32:41.488Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 20:32 WIB

Official record

HighPublished 28 Mar 2026, 00:05 WIB

CVE-2026-4962

UltraVNC Service version.dll uncontrolled search path

A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknown functionality in the library version.dll of the component Service. The manipulation results in uncontrolled search path. The attack needs to be approached locally. This attack is characterized by high complexity. The e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T17:05:16.691Z. Updated 2026-03-27T22:07:28.414Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 05:07 WIB

Official record

MedPublished 27 Mar 2026, 23:42 WIB

CVE-2026-34362

AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `verifyTokenSocket()` function in `plugin/YPTSocket/functions.php` has its token timeout validation commented out, causing WebSocket tokens to never expire despite being generated with a 12-hour timeout. This allows captured or legi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:42:28.779Z. Updated 2026-03-31T13:30:30.433Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 20:30 WIB

Official record

MedPublished 27 Mar 2026, 23:39 WIB

CVE-2026-34247

AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary `live_schedule_id`. The endpoint only checks `User::isLogged()` but never ve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:39:05.219Z. Updated 2026-03-27T17:29:15.757Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 00:29 WIB

Official record

HighPublished 27 Mar 2026, 23:38 WIB

CVE-2025-15616

Wazuh Agent and Manager OS Command Injection and Untrusted Search Path

Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR script parameters. Attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:38:20.559Z. Updated 2026-07-14T22:25:33.927Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 05:25 WIB

Official record

MedPublished 27 Mar 2026, 23:32 WIB

CVE-2026-34245

AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/PlayLists/View/Playlists_schedules/add.json.php` endpoint allows any authenticated user with streaming permission to create or modify broadcast schedules targeting any playlist on the platform, regardless of ownership. When …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:32:35.615Z. Updated 2026-03-31T15:10:30.387Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 22:10 WIB

Official record

CritPublished 27 Mar 2026, 23:30 WIB

CVE-2026-33867

AVideo has Plaintext Video Password Storage

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL inj…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:30:17.182Z. Updated 2026-03-27T19:57:15.696Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 02:57 WIB

Official record

MedPublished 27 Mar 2026, 23:24 WIB

CVE-2026-34411

Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs

Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email doma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:24:16.385Z. Updated 2026-07-14T18:40:27.887Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:40 WIB

Official record