Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6121–6140 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 18 Aug 2026, 00:53 WIB

CVE-2026-73522

COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write index without boundin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:53:20.700Z. Updated 2026-08-18T14:53:19.674Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:53 WIB

Official record

HighPublished 18 Aug 2026, 00:50 WIB

CVE-2026-71980

Belledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe()

Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload cause…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 6121 to 6140 of 12259.First page Next page

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:50:41.205Z. Updated 2026-08-17T18:12:49.074Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:12 WIB

Official record

HighPublished 18 Aug 2026, 00:48 WIB

CVE-2026-59902

Netty: Memory Exhaustion in SctpMessageCompletionHandler

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. Thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:48:55.663Z. Updated 2026-08-18T14:50:42.964Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:50 WIB

Official record

HighPublished 18 Aug 2026, 00:43 WIB

CVE-2026-54284

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:43:48.243Z. Updated 2026-08-17T19:32:42.004Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:32 WIB

Official record

HighPublished 18 Aug 2026, 00:41 WIB

CVE-2026-59893

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:41:36.621Z. Updated 2026-08-17T18:54:26.754Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:54 WIB

Official record

HighPublished 18 Aug 2026, 00:40 WIB

CVE-2026-71979

INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing

INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TC…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:40:38.095Z. Updated 2026-08-17T19:34:33.061Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:34 WIB

Official record

HighPublished 18 Aug 2026, 00:16 WIB

CVE-2026-71491

sqlparse: Quadratic O(n²) DoS in group_comments

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:16:48.973Z. Updated 2026-08-17T22:01:34.222Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 05:01 WIB

Official record

MedPublished 18 Aug 2026, 00:14 WIB

CVE-2026-59894

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:14:22.314Z. Updated 2026-08-17T22:01:42.744Z.

CVSS6.2v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 05:01 WIB

Official record

CritPublished 18 Aug 2026, 00:12 WIB

CVE-2026-74253

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes {source} blocks found in Joomla’s final rendered HTML without reliably determining where that code originated.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:12:55.129Z. Updated 2026-08-26T06:57:48.917Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 13:57 WIB

Official record

MedPublished 18 Aug 2026, 00:11 WIB

CVE-2026-73424

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:11:59.782Z. Updated 2026-08-18T14:49:18.484Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:49 WIB

Official record

HighPublished 18 Aug 2026, 00:10 WIB

CVE-2026-68519

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:10:25.951Z. Updated 2026-08-17T17:30:32.566Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 00:30 WIB

Official record

CritPublished 18 Aug 2026, 00:10 WIB

CVE-2026-74254

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:10:04.122Z. Updated 2026-08-24T07:54:30.814Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Aug 2026, 14:54 WIB

Official record

HighPublished 18 Aug 2026, 00:07 WIB

CVE-2026-62982

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render() and be executed by secure_popen() through administrator-c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:07:49.364Z. Updated 2026-08-17T18:53:15.749Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:53 WIB

Official record

MedPublished 18 Aug 2026, 00:06 WIB

CVE-2026-68520

Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:06:06.446Z. Updated 2026-08-17T19:36:26.683Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:36 WIB

Official record

MedPublished 18 Aug 2026, 00:03 WIB

CVE-2026-68517

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API dat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T17:03:23.346Z. Updated 2026-08-18T14:48:25.958Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:48 WIB

Official record

HighPublished 17 Aug 2026, 23:29 WIB

CVE-2026-40145

Control protections bypass in BeyondTrust Endpoint Privilege Management (Windows deployment) support utility

A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:29:12.385Z. Updated 2026-08-17T18:17:49.348Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:17 WIB

Official record

MedPublished 17 Aug 2026, 23:18 WIB

CVE-2026-12519

Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a2a.c). The response line is linearized into a fixed 40-byte stack buffer via net_buf_linearize(), which caps the copy at 39 bytes and returns out_len <= 39. The two quote-delimiter…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:18:53.758Z. Updated 2026-08-17T18:22:49.443Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:22 WIB

Official record

HighPublished 17 Aug 2026, 23:18 WIB

CVE-2026-9771

Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation

The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer (K_SYSCALL_MEMORY_WRITE) and passed the two struct device * …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:18:52.514Z. Updated 2026-08-17T18:25:14.470Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:25 WIB

Official record

MedPublished 17 Aug 2026, 23:18 WIB

CVE-2026-12630

6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode

Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC dispatch word (…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:18:51.419Z. Updated 2026-08-17T18:26:16.046Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:26 WIB

Official record

MedPublished 17 Aug 2026, 23:18 WIB

CVE-2026-12629

PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service

The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrupts. On the PL011, the framing, parity, break, and overrun error interrupts (PL011_IMSC_ERROR_MASK) are cleared only by writing the interrupt-clear register UARTICR; reading the data register clears the RX interrupt and t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:18:50.322Z. Updated 2026-08-17T18:27:37.225Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:27 WIB

Official record