Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6101–6120 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 18 Aug 2026, 02:56 WIB

CVE-2026-63667

ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path rema…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T19:56:07.436Z. Updated 2026-08-17T20:05:42.231Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 03:05 WIB

Official record

MedPublished 18 Aug 2026, 02:49 WIB

CVE-2026-63670

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 6101 to 6120 of 12259.First page Next page

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T19:49:51.903Z. Updated 2026-08-18T18:08:30.331Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 01:08 WIB

Official record

MedPublished 18 Aug 2026, 02:45 WIB

CVE-2026-75014

SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T19:45:09.243Z. Updated 2026-08-17T19:53:30.061Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:53 WIB

Official record

MedPublished 18 Aug 2026, 02:41 WIB

CVE-2026-63669

ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T19:41:52.574Z. Updated 2026-08-17T22:01:18.244Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 05:01 WIB

Official record

HighPublished 18 Aug 2026, 02:31 WIB

CVE-2026-57485

Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T19:31:30.833Z. Updated 2026-08-18T15:19:14.801Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:19 WIB

Official record

HighPublished 18 Aug 2026, 02:30 WIB

CVE-2026-75013

TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference

A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation results in null pointer dereference. The attack can be launched remotely. The exploit is now public and may be used.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T19:30:11.074Z. Updated 2026-08-18T14:54:44.857Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:54 WIB

Official record

CritPublished 18 Aug 2026, 02:28 WIB

CVE-2026-71472

Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string provided in the Search CR is not properly validated before bein…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T19:28:43.057Z. Updated 2026-09-05T14:24:27.774Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated05 Sep 2026, 21:24 WIB

Official record

HighPublished 18 Aug 2026, 02:28 WIB

CVE-2026-70495

Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` acc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T19:28:37.995Z. Updated 2026-09-05T14:24:02.182Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Sep 2026, 21:24 WIB

Official record

HighPublished 18 Aug 2026, 02:15 WIB

CVE-2026-75012

TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference

A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be initiated remotely. The expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T19:15:09.293Z. Updated 2026-08-18T12:31:41.299Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 19:31 WIB

Official record

MedPublished 18 Aug 2026, 01:35 WIB

CVE-2026-17639

Certain HP Smart Tank All in One – Potential Denial of Service

Certain HP Smart Tank All-in-One printers may be potentially vulnerable to a denial of service condition that allows an unauthenticated attacker to cause the device to become unavailable by sending multiple concurrent HTTP requests.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T18:35:32.360Z. Updated 2026-08-17T18:59:22.318Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:59 WIB

Official record

HighPublished 18 Aug 2026, 01:21 WIB

CVE-2026-45698

Netatalk has Integer Underflow → Stack Buffer Overflow in deletedir()

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. delet…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T18:21:19.925Z. Updated 2026-08-17T19:29:54.873Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:29 WIB

Official record

MedPublished 18 Aug 2026, 01:15 WIB

CVE-2026-75011

kylecui NetForensicMCP index.js execAsync command injection

A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of the argument interface/protocol can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T18:15:08.708Z. Updated 2026-08-19T14:44:17.754Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:44 WIB

Official record

HighPublished 18 Aug 2026, 01:13 WIB

CVE-2026-12553

HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write

HP has identified a potential vulnerability in HP Web Jetadmin (WJA) that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism.

Excerpt language: en.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T18:13:23.065Z. Updated 2026-08-17T19:30:59.137Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:30 WIB

Official record

HighPublished 18 Aug 2026, 01:12 WIB

CVE-2026-74238

TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T18:12:37.894Z. Updated 2026-08-20T15:24:41.636Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:24 WIB

Official record

CritPublished 18 Aug 2026, 01:12 WIB

CVE-2026-66792

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T18:12:36.136Z. Updated 2026-09-29T16:44:20.747Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:44 WIB

Official record

HighPublished 18 Aug 2026, 01:00 WIB

CVE-2026-73523

COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The num_can_msgs variable declared …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T18:00:01.521Z. Updated 2026-08-17T18:12:52.559Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:12 WIB

Official record

HighPublished 18 Aug 2026, 00:58 WIB

CVE-2026-33437

Stirling PDF: Stored XSS in Info Summary

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with innerHTML, allowing a malicio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:58:22.857Z. Updated 2026-08-17T22:01:27.985Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 05:01 WIB

Official record

MedPublished 18 Aug 2026, 00:57 WIB

CVE-2026-48053

Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:57:05.139Z. Updated 2026-08-17T19:53:05.341Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:53 WIB

Official record

MedPublished 18 Aug 2026, 00:56 WIB

CVE-2026-59903

Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:56:28.726Z. Updated 2026-08-17T18:14:01.121Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:14 WIB

Official record

HighPublished 18 Aug 2026, 00:54 WIB

CVE-2026-46345

compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:54:16.944Z. Updated 2026-08-17T18:03:44.422Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:03 WIB

Official record