Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 19 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 19
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 621–640 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 28 Oct 2026, 23:45 WIB

CVE-2026-111496

Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:45:08.114Z. Updated 2026-10-28T20:06:55.726Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:06 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:44 WIB

CVE-2026-111115

Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing

Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size (socket.request.max.bytes); it was not checked against the remaining buffer bytes o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 621 to 640 of 16156.First page Next page

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:44:53.268Z. Updated 2026-10-28T20:06:54.294Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:06 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:38 WIB

CVE-2026-111108

Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request can declare far more el…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:38:08.524Z. Updated 2026-10-28T20:06:52.812Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:06 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:37 WIB

CVE-2026-111073

Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the decompressed output size, growing a heap buffer until the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:37:58.482Z. Updated 2026-10-28T20:06:51.327Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:06 WIB

Official record

HighPublished 28 Oct 2026, 23:37 WIB

CVE-2026-106079

Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:37:49.668Z. Updated 2026-10-28T16:37:49.668Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:37 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:37 WIB

CVE-2026-110985

Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset (the default) and no verification ke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:37:45.688Z. Updated 2026-10-28T16:37:45.688Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:37 WIB

Official record

HighPublished 28 Oct 2026, 23:37 WIB

CVE-2026-103411

Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing

An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:37:35.468Z. Updated 2026-10-28T16:37:35.468Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:37 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:37 WIB

CVE-2026-110952

Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer (iss) claim is verified only when sasl.oauthbearer.expected.issuer is set. When it is unset, a va…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:37:34.723Z. Updated 2026-10-28T16:37:34.723Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:37 WIB

Official record

UnscoredPublished 28 Oct 2026, 23:37 WIB

CVE-2026-83525

Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:37:19.893Z. Updated 2026-10-28T20:07:03.066Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 03:07 WIB

Official record

HighPublished 28 Oct 2026, 23:37 WIB

CVE-2026-103410

Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection

An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:37:17.946Z. Updated 2026-10-29T01:52:03.380Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:52 WIB

Official record

CritPublished 28 Oct 2026, 23:36 WIB

CVE-2026-103409

Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed

A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:36:46.539Z. Updated 2026-10-28T16:36:46.539Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:36 WIB

Official record

HighPublished 28 Oct 2026, 23:36 WIB

CVE-2026-103408

Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:36:33.095Z. Updated 2026-10-28T16:36:33.095Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:36 WIB

Official record

HighPublished 28 Oct 2026, 23:36 WIB

CVE-2026-103407

Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-k…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:36:19.559Z. Updated 2026-10-28T16:36:19.559Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:36 WIB

Official record

CritPublished 28 Oct 2026, 23:35 WIB

CVE-2026-103406

Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:35:53.323Z. Updated 2026-10-28T16:35:53.323Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:35 WIB

Official record

MedPublished 28 Oct 2026, 23:35 WIB

CVE-2026-103405

Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting

An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:35:39.369Z. Updated 2026-10-28T16:35:39.369Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:35 WIB

Official record

MedPublished 28 Oct 2026, 23:35 WIB

CVE-2026-103404

Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials

An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:35:25.296Z. Updated 2026-10-28T16:35:25.296Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:35 WIB

Official record

HighPublished 28 Oct 2026, 23:35 WIB

CVE-2026-103403

Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:35:11.327Z. Updated 2026-10-28T16:35:11.327Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:35 WIB

Official record

HighPublished 28 Oct 2026, 23:34 WIB

CVE-2026-103402

Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation

An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:34:58.448Z. Updated 2026-10-28T16:34:58.448Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:34 WIB

Official record

HighPublished 28 Oct 2026, 23:34 WIB

CVE-2026-103401

Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root

An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:34:44.566Z. Updated 2026-10-28T16:34:44.566Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:34 WIB

Official record

MedPublished 28 Oct 2026, 23:34 WIB

CVE-2026-103400

Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup

An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the ember service in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with local access to unmount arbitrary filesystems or cause a denial of service via the creatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:34:29.792Z. Updated 2026-10-29T01:52:03.696Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:52 WIB

Official record