Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 601–620 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 29 Aug 2026, 00:31 WIB

CVE-2026-55566

Yamcs: DOM XSS in Extension Routing

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin IDs before DOM renderi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T17:31:39.197Z. Updated 2026-08-28T20:31:29.178Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 03:31 WIB

Official record

CritPublished 29 Aug 2026, 00:29 WIB

CVE-2026-55565

Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 601 to 620 of 12259.First page Next page

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T17:29:56.768Z. Updated 2026-08-31T18:54:38.310Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:54 WIB

Official record

CritPublished 29 Aug 2026, 00:22 WIB

CVE-2026-55559

Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T17:22:07.633Z. Updated 2026-08-28T19:58:04.713Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 02:58 WIB

Official record

HighPublished 29 Aug 2026, 00:18 WIB

CVE-2026-55552

Yamcs: Unauthenticated Directory Traversal

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intend…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T17:18:45.617Z. Updated 2026-08-31T18:54:23.899Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:54 WIB

Official record

MedPublished 29 Aug 2026, 00:15 WIB

CVE-2026-55549

Yamcs: Reflected XSS in the URL of the Authorize Endpoint

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java and yamcs-core/src/…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T17:15:52.840Z. Updated 2026-09-01T01:49:34.239Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 08:49 WIB

Official record

MedPublished 29 Aug 2026, 00:11 WIB

CVE-2026-55547

Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T17:11:34.332Z. Updated 2026-08-28T20:30:11.670Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 03:30 WIB

Official record

MedPublished 29 Aug 2026, 00:09 WIB

CVE-2026-55545

Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket, ProcessingApi.subscribeAlgorithmStatus exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T17:09:53.114Z. Updated 2026-08-31T18:55:41.849Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:55 WIB

Official record

HighPublished 29 Aug 2026, 00:08 WIB

CVE-2026-55521

Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read packet and event index…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T17:08:16.725Z. Updated 2026-08-28T19:52:43.290Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 02:52 WIB

Official record

HighPublished 29 Aug 2026, 00:06 WIB

CVE-2026-77939

Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage expos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T17:06:51.132Z. Updated 2026-08-29T11:47:55.894Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:47 WIB

Official record

CritPublished 29 Aug 2026, 00:05 WIB

CVE-2026-55511

Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T17:05:02.307Z. Updated 2026-09-01T01:47:25.316Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 08:47 WIB

Official record

CritPublished 28 Aug 2026, 23:57 WIB

CVE-2026-55068

free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints ad…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T16:57:12.269Z. Updated 2026-08-31T18:56:29.059Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:56 WIB

Official record

MedPublished 28 Aug 2026, 23:53 WIB

CVE-2026-55067

Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currently belongs to th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T16:53:59.656Z. Updated 2026-08-28T19:55:24.677Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 02:55 WIB

Official record

HighPublished 28 Aug 2026, 23:51 WIB

CVE-2026-55066

Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T16:51:48.114Z. Updated 2026-08-31T18:54:28.170Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:54 WIB

Official record

HighPublished 28 Aug 2026, 23:40 WIB

CVE-2026-55065

Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier. ProjectView.CanDelete in pkg/mode…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T16:40:27.706Z. Updated 2026-09-01T01:46:09.120Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 08:46 WIB

Official record

MedPublished 28 Aug 2026, 23:38 WIB

CVE-2026-55064

Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T16:38:38.293Z. Updated 2026-08-28T20:29:30.143Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 03:29 WIB

Official record

MedPublished 28 Aug 2026, 23:36 WIB

CVE-2026-54766

Vikunja: Project duplication bypasses write-permission check on the target parent project

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/project_duplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project. ProjectDuplicate.CanCreate calls par…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T16:36:57.857Z. Updated 2026-08-28T19:59:25.820Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 02:59 WIB

Official record

HighPublished 28 Aug 2026, 23:33 WIB

CVE-2026-54788

dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS

dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T16:33:49.032Z. Updated 2026-08-31T18:57:14.867Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:57 WIB

Official record

MedPublished 28 Aug 2026, 23:27 WIB

CVE-2026-55834

Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirect_uri query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when prompt=none cannot comp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T16:27:58.324Z. Updated 2026-08-28T20:28:38.924Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 03:28 WIB

Official record

MedPublished 28 Aug 2026, 23:26 WIB

CVE-2026-55569

aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry at the same archive path…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T16:26:51.328Z. Updated 2026-09-01T01:44:40.571Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 08:44 WIB

Official record

MedPublished 28 Aug 2026, 23:26 WIB

CVE-2026-82343

Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T16:26:13.284Z. Updated 2026-09-01T14:59:39.177Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:59 WIB

Official record