Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 601–620 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 30 Sep 2026, 09:00 WIB

CVE-2026-102847

gedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting

A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku_tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes cross site scripting. Re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T02:00:14.356Z. Updated 2026-09-30T17:10:52.298Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:10 WIB

Official record

MedPublished 30 Sep 2026, 08:51 WIB

CVE-2026-81310

CVE-2026-81310

Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 601 to 620 of 14934.First page Next page

Published 2026-09-30T01:51:54.487Z. Updated 2026-09-30T16:57:19.086Z.

CVSS5.2v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:57 WIB

Official record

MedPublished 30 Sep 2026, 08:51 WIB

CVE-2026-78229

CVE-2026-78229

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T01:51:37.656Z. Updated 2026-09-30T15:28:12.170Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

MedPublished 30 Sep 2026, 08:45 WIB

CVE-2026-102846

gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization

A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting resu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T01:45:20.309Z. Updated 2026-10-02T12:49:29.941Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:49 WIB

Official record

MedPublished 30 Sep 2026, 08:30 WIB

CVE-2026-102845

gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function error_reporting of the file index.php of the component HTTP Response. The manipulation leads to information disclosure. The attack may be initiated remotely. The e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T01:30:12.367Z. Updated 2026-09-30T13:55:33.621Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:55 WIB

Official record

MedPublished 30 Sep 2026, 08:15 WIB

CVE-2026-102844

gedelumbung HospitalManagement laporan_data_pasien.php detail authorization

A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporan_data_pasien.php. Executing a manipulation of the argument id_param can lead to authorization bypass. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T01:15:07.489Z. Updated 2026-09-30T17:12:17.534Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:12 WIB

Official record

MedPublished 30 Sep 2026, 08:00 WIB

CVE-2026-102843

gedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversal

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/data_galeri.php of the component Endpoint. Performing a manipulation of the argument gbr results in path traversal. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T01:00:11.771Z. Updated 2026-10-02T12:48:22.756Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:48 WIB

Official record

HighPublished 30 Sep 2026, 07:55 WIB

CVE-2026-103088

CVE-2026-103088

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:55:19.940Z. Updated 2026-09-30T17:21:46.603Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:21 WIB

Official record

HighPublished 30 Sep 2026, 07:35 WIB

CVE-2026-103087

CVE-2026-103087

Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stack exhaustion and application crash) via an SVG document containing an excessive number of deeply nested elements. Because the engine does not limit th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:35:06.196Z. Updated 2026-09-30T19:08:33.809Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:08 WIB

Official record

MedPublished 30 Sep 2026, 07:30 WIB

CVE-2026-102842

gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_user_login_model.php::cekUserLogin of the file application/models/app_user_login_model.php of the component KCFinder File Manager. Such manipulation of the argument…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:30:15.964Z. Updated 2026-09-30T13:56:03.229Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:56 WIB

Official record

LowPublished 30 Sep 2026, 07:19 WIB

CVE-2026-51936

CVE-2026-51936

Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted databases. It needs to do dynamic schema manipulation, and thus the function temporaril…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:19:30.222Z. Updated 2026-10-02T12:47:39.325Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:47 WIB

Official record

MedPublished 30 Sep 2026, 07:19 WIB

CVE-2026-103057

AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or sen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:19:12.549Z. Updated 2026-09-30T13:56:57.220Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:56 WIB

Official record

CritPublished 30 Sep 2026, 07:19 WIB

CVE-2026-103056

AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_nam…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:19:11.887Z. Updated 2026-09-30T18:09:32.342Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 01:09 WIB

Official record

HighPublished 30 Sep 2026, 07:19 WIB

CVE-2026-103055

AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:19:11.252Z. Updated 2026-10-02T12:45:59.952Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:45 WIB

Official record

HighPublished 30 Sep 2026, 07:19 WIB

CVE-2026-103054

AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfolio endpoint to claim unclaimed tenants and read their security alerts, incidents,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:19:10.583Z. Updated 2026-09-30T16:56:38.804Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:56 WIB

Official record

MedPublished 30 Sep 2026, 07:19 WIB

CVE-2026-103053

AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:19:09.978Z. Updated 2026-09-30T13:57:54.515Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:57 WIB

Official record

MedPublished 30 Sep 2026, 07:15 WIB

CVE-2026-102805

Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow

A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h of the component Image Encoding. Executing a manipulation can lead to integer overflow. The attack can be executed remotely. The exploit has been pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:15:17.198Z. Updated 2026-10-01T15:51:40.014Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:51 WIB

Official record

MedPublished 30 Sep 2026, 07:00 WIB

CVE-2026-102804

Nothings stb stb_hexwave.h hexwave_init integer overflow

A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of the argument width/oversample results in integer overflow. Remote exploitation of the attack is possible. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:00:17.544Z. Updated 2026-10-02T12:43:20.019Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:43 WIB

Official record

HighPublished 30 Sep 2026, 07:00 WIB

CVE-2026-51568

CVE-2026-51568

modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:00:00.000Z. Updated 2026-10-01T16:12:02.119Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 23:12 WIB

Official record

HighPublished 30 Sep 2026, 07:00 WIB

CVE-2026-51570

CVE-2026-51570

modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T00:00:00.000Z. Updated 2026-10-02T12:33:30.867Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:33 WIB

Official record