Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 621–640 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 27 Mar 2026, 23:23 WIB

CVE-2025-15615

Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:23:03.804Z. Updated 2026-07-14T22:25:33.250Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 05:25 WIB

Official record

HighPublished 27 Mar 2026, 23:17 WIB

CVE-2025-15381

Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow

In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 621 to 640 of 6236.First page Next page

Severity high: primary CNA CVSS 8.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:17:30.328Z. Updated 2026-07-15T01:26:58.681Z.

CVSS8.1v3.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:26 WIB

Official record

HighPublished 27 Mar 2026, 23:13 WIB

CVE-2026-33770

AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `fixCleanTitle()` static method in `objects/category.php` constructs a SQL SELECT query by directly interpolating both `$clean_title` and `$id` into the query string without using prepared statements or parameterized queries. An att…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:13:51.872Z. Updated 2026-03-31T13:29:27.273Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 20:29 WIB

Official record

HighPublished 27 Mar 2026, 23:13 WIB

CVE-2026-28369

Undertow: undertow: request smuggling via malformed http request headers

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Reque…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:13:05.719Z. Updated 2026-10-14T16:32:08.800Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated14 Oct 2026, 23:32 WIB

Official record

HighPublished 27 Mar 2026, 23:13 WIB

CVE-2026-28367

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:13:05.108Z. Updated 2026-10-14T16:31:32.664Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated14 Oct 2026, 23:31 WIB

Official record

HighPublished 27 Mar 2026, 23:13 WIB

CVE-2026-28368

Undertow: undertow: request smuggling via inconsistent header parsing

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing secu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:13:03.775Z. Updated 2026-10-14T16:31:57.233Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated14 Oct 2026, 23:31 WIB

Official record

HighPublished 27 Mar 2026, 23:12 WIB

CVE-2026-33767

AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like.php`, the `getLike()` method constructs a SQL query using a prepared statement placeholder (`?`) for `users_id` but directly concatenates `$this->videos_id` into the query string without parameterization. An attacker wh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:12:36.907Z. Updated 2026-03-27T17:27:42.793Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 00:27 WIB

Official record

HighPublished 27 Mar 2026, 23:09 WIB

CVE-2026-4961

Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow

A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack is possible to be carried out remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:09:39.618Z. Updated 2026-03-27T22:07:24.530Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 05:07 WIB

Official record

HighPublished 27 Mar 2026, 23:09 WIB

CVE-2026-4960

Tenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflow

A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T16:09:34.784Z. Updated 2026-03-27T22:07:09.941Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 05:07 WIB

Official record

MedPublished 27 Mar 2026, 22:52 WIB

CVE-2023-7340

Wazuh authd service (os_auth) Heap-based Buffer Overflow

Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers can exploit this vulnerability to trigger a denial of service condition, resulting in low availability impact to the authentication daemon.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T15:52:47.751Z. Updated 2026-07-15T01:25:00.470Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:25 WIB

Official record

MedPublished 27 Mar 2026, 22:44 WIB

CVE-2026-32983

SSL/TLS Renegotiation DoS in Wazuh Manager authd service

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T15:44:30.671Z. Updated 2026-07-14T18:40:09.844Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:40 WIB

Official record

MedPublished 27 Mar 2026, 22:31 WIB

CVE-2026-4959

OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication

A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results in missing authentication. Remote exploitation of the attack …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T15:31:29.753Z. Updated 2026-03-31T15:09:19.380Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Mar 2026, 22:09 WIB

Official record

LowPublished 27 Mar 2026, 22:31 WIB

CVE-2026-4958

OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization

A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/application/websockets/replayer.py of the component WebSocket Endpoint. Such manipulation of the argument interaction_id leads to authorization bypass. The attack may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T15:31:27.729Z. Updated 2026-03-30T12:09:48.220Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 19:09 WIB

Official record

MedPublished 27 Mar 2026, 22:02 WIB

CVE-2026-32984

Heap buffer overflow in wazuh-authd

Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers can exploit this vulnerability to trigger a denial of service condition, resulting in low impact on the availability of the authentication daem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T15:02:47.575Z. Updated 2026-07-14T18:40:10.548Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 01:40 WIB

Official record

HighPublished 27 Mar 2026, 21:54 WIB

CVE-2026-5027

Langflow - Path Traversal Arbitrary File Write via upload_user_file

The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:54:53.609Z. Updated 2026-03-27T15:11:42.918Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 22:11 WIB

Official record

MedPublished 27 Mar 2026, 21:52 WIB

CVE-2026-4957

OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file

A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of the component API Key Handler. This manipulation of the argument api_key causes sensitive information in log files. The attack may be initiated remotely. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:52:21.328Z. Updated 2026-03-27T15:31:57.067Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 22:31 WIB

Official record

MedPublished 27 Mar 2026, 21:52 WIB

CVE-2026-4956

Shenzhen Ruiming Technology Streamax Crocus Parameter DevicePrint.do sql injection

A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. The affected element is an unknown function of the file /DevicePrint.do?Action=ReadTask of the component Parameter Handler. The manipulation of the argument State results in sql injection. The attack can be launched remotely. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:52:19.176Z. Updated 2026-03-27T17:25:01.054Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 00:25 WIB

Official record

MedPublished 27 Mar 2026, 21:51 WIB

CVE-2026-4955

Shenzhen Ruiming Technology Streamax Crocus OperateStatistic.do sql injection

A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. This impacts an unknown function of the file /OperateStatistic.do. The manipulation of the argument VehicleID results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:51:41.253Z. Updated 2026-03-27T19:57:55.525Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 02:57 WIB

Official record

MedPublished 27 Mar 2026, 21:50 WIB

CVE-2026-4980

Improper Restriction of XML External Entity Reference in Inkscape

A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:50:48.271Z. Updated 2026-10-26T18:10:37.229Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 01:10 WIB

Official record

HighPublished 27 Mar 2026, 21:50 WIB

CVE-2026-5026

Langflow - Stored XSS via Malicious SVG Upload

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content. Since SVG files can contain embedded JavaScript, an attacker can upload a malicious SVG that executes arbitrary JavaScript when viewed by other users, leading to stored cro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-27T14:50:36.603Z. Updated 2026-03-27T15:35:23.336Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 22:35 WIB

Official record