Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6061–6080 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 18 Aug 2026, 03:55 WIB

CVE-2026-65640

CVE-2026-65640

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:55:33.162Z. Updated 2026-08-18T15:17:13.043Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:17 WIB

Official record

HighPublished 18 Aug 2026, 03:55 WIB

CVE-2026-47683

vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 6061 to 6080 of 12259.First page Next page

Published 2026-08-17T20:55:32.019Z. Updated 2026-08-18T15:38:37.608Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:38 WIB

Official record

CritPublished 18 Aug 2026, 03:54 WIB

CVE-2026-47686

vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-expos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:54:39.406Z. Updated 2026-08-19T03:56:00.965Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 10:56 WIB

Official record

CritPublished 18 Aug 2026, 03:53 WIB

CVE-2026-47698

vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:53:09.218Z. Updated 2026-08-19T03:56:02.855Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 10:56 WIB

Official record

MedPublished 18 Aug 2026, 03:52 WIB

CVE-2026-75529

Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using send_file(task.file.path) without explic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:52:42.520Z. Updated 2026-08-18T15:16:47.908Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:16 WIB

Official record

HighPublished 18 Aug 2026, 03:51 WIB

CVE-2026-34398

FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval(), allowing arbitrary Pytho…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:51:56.717Z. Updated 2026-08-19T03:56:09.964Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 10:56 WIB

Official record

HighPublished 18 Aug 2026, 03:50 WIB

CVE-2026-34399

FreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw Page

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BI…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:50:19.829Z. Updated 2026-08-19T03:56:11.095Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 10:56 WIB

Official record

MedPublished 18 Aug 2026, 03:48 WIB

CVE-2026-68765

hashcat KeePass KDBX v4 Module Heap Buffer Overflow via Token Field

hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301) that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the ninth token field but dec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:48:17.215Z. Updated 2026-10-27T10:14:28.799Z.

CVSS5.2v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:14 WIB

Official record

HighPublished 18 Aug 2026, 03:47 WIB

CVE-2026-34789

FreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:47:52.373Z. Updated 2026-08-19T03:56:12.224Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 10:56 WIB

Official record

HighPublished 18 Aug 2026, 03:45 WIB

CVE-2026-65822

ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extrac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:45:45.647Z. Updated 2026-08-18T13:01:42.822Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:01 WIB

Official record

CritPublished 18 Aug 2026, 03:45 WIB

CVE-2026-66795

Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:45:33.786Z. Updated 2026-09-29T19:41:20.174Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:41 WIB

Official record

CritPublished 18 Aug 2026, 03:44 WIB

CVE-2026-65974

ERPNext: Server-Side Template Injection leading to Remote Code Execution

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code exe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:44:20.818Z. Updated 2026-08-18T14:17:47.852Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:17 WIB

Official record

HighPublished 18 Aug 2026, 03:39 WIB

CVE-2026-40506

OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traver…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:39:03.333Z. Updated 2026-10-01T15:19:57.220Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

MedPublished 18 Aug 2026, 03:36 WIB

CVE-2026-75483

powerlevel10k Control Character Injection via package.json Version

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:36:08.150Z. Updated 2026-08-20T15:24:24.081Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:24 WIB

Official record

HighPublished 18 Aug 2026, 03:36 WIB

CVE-2026-75482

SWE-agent Trajectory Inspector Path Traversal File Disclosure

SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory ('..') references, bypassing the built-in path sanitization. The server binds all interfaces (0.0.0.0), applie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:36:07.463Z. Updated 2026-09-24T14:19:27.737Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

HighPublished 18 Aug 2026, 03:36 WIB

CVE-2026-75481

SkyPilot Authentication Bypass via Service Account Role Escalation

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:36:06.800Z. Updated 2026-09-24T14:19:26.813Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

HighPublished 18 Aug 2026, 03:36 WIB

CVE-2026-75480

OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the sam…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:36:06.111Z. Updated 2026-09-24T14:19:25.843Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

HighPublished 18 Aug 2026, 03:36 WIB

CVE-2026-75479

JimuReport Unauthenticated Report Listing and Share Token Disclosure

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:36:05.442Z. Updated 2026-09-24T14:19:24.908Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

HighPublished 18 Aug 2026, 03:36 WIB

CVE-2026-75111

Evidently UI Path Traversal via Dataset Materialization Filename

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then mate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:36:04.764Z. Updated 2026-09-24T14:19:23.937Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

CritPublished 18 Aug 2026, 03:36 WIB

CVE-2026-75110

MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVI…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T20:36:04.095Z. Updated 2026-09-24T14:19:23.001Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record