Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 19 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 19
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 601–620 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117626

CVE-2026-117626

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:37.200Z. Updated 2026-10-28T16:48:37.200Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117625

CVE-2026-117625

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:36.625Z. Updated 2026-10-28T16:48:36.625Z.

Showing 601 to 620 of 16156.First page Next page

CVSS—

KEVNot listed

EPSSPresent

Updated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117624

CVE-2026-117624

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested object…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:36.029Z. Updated 2026-10-28T16:48:36.029Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117623

CVE-2026-117623

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:35.438Z. Updated 2026-10-28T16:48:35.438Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117622

CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:34.850Z. Updated 2026-10-28T16:48:34.850Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117621

CVE-2026-117621

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:34.260Z. Updated 2026-10-28T16:48:34.260Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117620

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:33.708Z. Updated 2026-10-28T16:48:33.708Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117619

CVE-2026-117619

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:33.134Z. Updated 2026-10-28T16:48:33.134Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117618

CVE-2026-117618

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:32.556Z. Updated 2026-10-28T16:48:32.556Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117617

CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure perm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:31.962Z. Updated 2026-10-28T16:48:31.962Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117616

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:31.398Z. Updated 2026-10-28T16:48:31.398Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117615

CVE-2026-117615

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:30.831Z. Updated 2026-10-28T16:48:30.831Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117614

CVE-2026-117614

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:30.245Z. Updated 2026-10-28T16:48:30.245Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117613

CVE-2026-117613

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:29.684Z. Updated 2026-10-28T16:48:29.684Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:48 WIB

CVE-2026-117612

CVE-2026-117612

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:48:29.130Z. Updated 2026-10-28T16:48:29.130Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:46 WIB

CVE-2026-114349

Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches

When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not constrain it, so a sma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:46:54.920Z. Updated 2026-10-29T13:48:26.738Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:48 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:46 WIB

CVE-2026-112375

Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs

An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment variable from the broker host and return its contents. An IncrementalAlterConfigs (or AlterConfigs) request targeting a BROKER resource reaches the broker's configuration validation bef…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:46:38.006Z. Updated 2026-10-28T16:46:38.006Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:46 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:46 WIB

CVE-2026-116593

Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An attacker with access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:46:21.415Z. Updated 2026-10-28T20:07:01.640Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:07 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:45 WIB

CVE-2026-115644

Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring the "admin.listeners" property, REST extensions specified v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:45:36.440Z. Updated 2026-10-28T20:07:00.157Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:07 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:45 WIB

CVE-2026-111551

Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore declare a very large size and force a multi-gigabyte allocation. The affected paths…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:45:25.163Z. Updated 2026-10-28T20:06:57.172Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:06 WIB

Official record