Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6141–6160 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 17 Aug 2026, 23:18 WIB

CVE-2026-68518

Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables to reconstruct shell operators that secure_popen() executes when attacker-controll…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:18:29.391Z. Updated 2026-08-17T19:37:48.603Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:37 WIB

Official record

HighPublished 17 Aug 2026, 23:16 WIB

CVE-2026-61666

websocket-driver: Denial of service via malformed Host header

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does no…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 6141 to 6160 of 12259.First page Next page

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:16:33.374Z. Updated 2026-08-17T17:00:52.736Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 00:00 WIB

Official record

MedPublished 17 Aug 2026, 23:13 WIB

CVE-2026-64865

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:13:37.664Z. Updated 2026-08-18T14:47:21.494Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:47 WIB

Official record

CritPublished 17 Aug 2026, 23:11 WIB

CVE-2026-71479

New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:11:28.485Z. Updated 2026-08-17T18:59:30.302Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:59 WIB

Official record

MedPublished 17 Aug 2026, 23:06 WIB

CVE-2026-64866

New API: Admin can reset passkeys for same-level or higher-privileged users

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:06:38.718Z. Updated 2026-08-17T22:01:49.775Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 05:01 WIB

Official record

HighPublished 17 Aug 2026, 23:05 WIB

CVE-2026-40144

Memory corruption vulnerability in Endpoint Privilege Management (Windows deployments)

A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2. Insufficient validation of input processed by the component may result in memory being accessed outside its intended bounds.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T16:05:43.446Z. Updated 2026-08-17T18:28:37.263Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:28 WIB

Official record

HighPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75060

CVE-2026-75060

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:40.464Z. Updated 2026-08-18T03:55:36.130Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 10:55 WIB

Official record

MedPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75059

CVE-2026-75059

In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:40.135Z. Updated 2026-08-18T03:55:37.215Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 10:55 WIB

Official record

MedPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75058

CVE-2026-75058

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:39.743Z. Updated 2026-08-17T18:30:14.949Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:30 WIB

Official record

MedPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75057

CVE-2026-75057

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:39.344Z. Updated 2026-09-17T18:44:25.722Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated18 Sep 2026, 01:44 WIB

Official record

HighPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75056

CVE-2026-75056

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:38.976Z. Updated 2026-08-18T03:55:38.767Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 10:55 WIB

Official record

MedPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75055

CVE-2026-75055

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:38.544Z. Updated 2026-08-17T16:15:31.832Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:15 WIB

Official record

MedPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75054

CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:38.230Z. Updated 2026-08-17T18:32:49.515Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:32 WIB

Official record

MedPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75053

CVE-2026-75053

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:37.854Z. Updated 2026-08-17T16:15:47.105Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:15 WIB

Official record

LowPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75052

CVE-2026-75052

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects

Excerpt language: en.

Severity low: primary CNA CVSS 3.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:37.499Z. Updated 2026-08-17T18:34:44.269Z.

CVSS3.6v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:34 WIB

Official record

HighPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75051

CVE-2026-75051

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:37.065Z. Updated 2026-08-18T03:55:41.997Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 10:55 WIB

Official record

HighPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75050

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:36.738Z. Updated 2026-08-17T16:16:03.593Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:16 WIB

Official record

MedPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75049

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:36.389Z. Updated 2026-08-17T16:16:18.721Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:16 WIB

Official record

HighPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75048

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:36.039Z. Updated 2026-08-17T16:16:33.192Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:16 WIB

Official record

MedPublished 17 Aug 2026, 22:54 WIB

CVE-2026-75047

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T15:54:35.553Z. Updated 2026-08-17T16:16:48.386Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:16 WIB

Official record