Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 61–80 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82909

QuantumNous new-api Revoked API Token token session expiration

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:09.755Z. Updated 2026-09-02T14:12:21.151Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 21:12 WIB

Official record

MedPublished 01 Sep 2026, 03:29 WIB

CVE-2026-81890

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.min…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 61 to 80 of 12259.First page Next page

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:29:43.695Z. Updated 2026-09-01T13:55:03.629Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:55 WIB

Official record

HighPublished 01 Sep 2026, 03:28 WIB

CVE-2026-54598

Missing Authentication for Critical Function in wallos

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:28:17.088Z. Updated 2026-09-02T14:11:14.379Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 21:11 WIB

Official record

MedPublished 01 Sep 2026, 03:27 WIB

CVE-2026-81888

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:27:33.165Z. Updated 2026-09-01T14:59:01.902Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:59 WIB

Official record

MedPublished 01 Sep 2026, 03:25 WIB

CVE-2026-50199

Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without their own provider key …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:25:41.238Z. Updated 2026-09-01T14:44:33.234Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:44 WIB

Official record

HighPublished 01 Sep 2026, 03:25 WIB

CVE-2026-81889

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsoc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:25:27.456Z. Updated 2026-09-03T18:04:09.418Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated04 Sep 2026, 01:04 WIB

Official record

MedPublished 01 Sep 2026, 03:25 WIB

CVE-2026-50198

Wallos: Cross-user subscription cost inference via replacement_subscription_id

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The write is accepted, and later the stats logic dereferences that foreign sub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:25:20.459Z. Updated 2026-09-01T16:39:36.272Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 23:39 WIB

Official record

CritPublished 01 Sep 2026, 03:15 WIB

CVE-2026-82908

MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow

A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/elementSize results in integer overflow. The attack requires a local appro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:15:09.231Z. Updated 2026-09-01T13:57:31.239Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:57 WIB

Official record

MedPublished 01 Sep 2026, 03:12 WIB

CVE-2026-81887

Livewire DOM-based cross-site scripting during client-side state handling

Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, and prototype path segments and creates inherited objects. Cli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:12:15.932Z. Updated 2026-09-03T18:03:10.981Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated04 Sep 2026, 01:03 WIB

Official record

MedPublished 01 Sep 2026, 03:09 WIB

CVE-2026-54179

backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:09:50.087Z. Updated 2026-09-01T14:59:11.540Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:59 WIB

Official record

MedPublished 01 Sep 2026, 03:00 WIB

CVE-2026-82906

sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The attack's complex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:00:10.019Z. Updated 2026-09-01T16:07:20.589Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 23:07 WIB

Official record

MedPublished 01 Sep 2026, 02:45 WIB

CVE-2026-82905

sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T19:45:08.514Z. Updated 2026-08-31T21:57:50.021Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 04:57 WIB

Official record

UnscoredPublished 01 Sep 2026, 02:37 WIB

CVE-2026-81267

Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T19:37:55.587Z. Updated 2026-08-31T20:09:56.066Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Sep 2026, 03:09 WIB

Official record

MedPublished 01 Sep 2026, 02:34 WIB

CVE-2026-14697

IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service

net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pending_queue is already non-empty (an NS is already outstanding), the function appends the data packet and returns early wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T19:34:49.586Z. Updated 2026-09-01T13:58:34.969Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:58 WIB

Official record

MedPublished 01 Sep 2026, 02:30 WIB

CVE-2026-82835

caoqianming django-vue-admin file access control

A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument file_id can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the public and could be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T19:30:08.728Z. Updated 2026-09-01T14:45:17.230Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:45 WIB

Official record

HighPublished 01 Sep 2026, 02:23 WIB

CVE-2026-13732

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the li…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T19:23:18.741Z. Updated 2026-10-14T19:02:17.891Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 02:02 WIB

Official record

MedPublished 01 Sep 2026, 02:16 WIB

CVE-2026-52730

Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view (not change) super admin-restricted module settings and leak the full module entity. Exploitation of the vulnerability is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T19:16:46.921Z. Updated 2026-09-02T14:10:20.138Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 21:10 WIB

Official record

MedPublished 01 Sep 2026, 02:15 WIB

CVE-2026-82834

Doccano Open Source Annotation Tools for Machine Learning Practitioners Bulk-Delete Endpoint category-types LabelList access control

A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. This affects the function LabelList of the file /v1/projects/1/category-types of the component Bulk-Delete Endpoint. Performi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T19:15:08.323Z. Updated 2026-09-02T14:09:44.724Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 21:09 WIB

Official record

MedPublished 01 Sep 2026, 02:00 WIB

CVE-2026-82833

Doccano Open Source Annotation Tools for Machine Learning Practitioners Project Example Detail Endpoint examples ExampleDetail access control

A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. Affected by this issue is the function ExampleDetail of the file /v1/projects/1/examples/ of the component Project Example Detail …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T19:00:08.707Z. Updated 2026-09-01T13:59:40.148Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:59 WIB

Official record

HighPublished 01 Sep 2026, 01:57 WIB

CVE-2026-53507

oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-refs: true). When an action runs on a pull request whose spec is attacker-controlled…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:57:41.097Z. Updated 2026-09-01T14:46:09.533Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:46 WIB

Official record