Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6241–6260 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

CritPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74876

openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:44.249Z. Updated 2026-10-08T15:24:49.937Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

CritPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74875

openssl_encrypt before 1.4.0 Schema Validation Bypass

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 6241 to 6260 of 12259.First page Next page

Published 2026-08-17T11:04:43.579Z. Updated 2026-10-08T15:24:49.333Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

HighPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74874

openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:42.912Z. Updated 2026-10-08T15:24:48.734Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

HighPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74873

openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:42.213Z. Updated 2026-10-08T15:24:48.193Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

CritPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74872

openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:41.525Z. Updated 2026-10-08T15:24:47.699Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

MedPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74871

openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOR

openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 sp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:40.877Z. Updated 2026-10-01T15:20:48.243Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:20 WIB

Official record

HighPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74870

openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:40.202Z. Updated 2026-10-01T15:20:47.578Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:20 WIB

Official record

HighPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74869

stoatchat before 0.15.0 Missing Authorization via Subscribe

stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:39.522Z. Updated 2026-08-17T16:04:14.984Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:04 WIB

Official record

HighPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74868

SiYuan before 3.7.4 Brute-Force Authentication via Publish Service

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:38.603Z. Updated 2026-08-17T14:38:44.022Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 21:38 WIB

Official record

LowPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74867

SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthorized actions on behalf …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:37.950Z. Updated 2026-08-18T14:34:36.624Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:34 WIB

Official record

HighPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74802

SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:37.285Z. Updated 2026-08-28T13:45:55.771Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 20:45 WIB

Official record

HighPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74801

SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:36.596Z. Updated 2026-08-17T15:16:34.015Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:16 WIB

Official record

CritPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74800

SiYuan before v3.7.4 Stored XSS via assets endpoint

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:35.938Z. Updated 2026-08-17T16:04:24.746Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:04 WIB

Official record

CritPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74799

SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:35.278Z. Updated 2026-08-17T14:53:27.144Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 21:53 WIB

Official record

CritPublished 17 Aug 2026, 18:04 WIB

CVE-2026-74798

SiYuan kernel Path Traversal via database_clean MCP tool

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView (kernel/model/attribute_view.go), which builds a filesystem path via filepath.Join without validating that i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T11:04:34.608Z. Updated 2026-08-18T14:31:27.824Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:31 WIB

Official record

MedPublished 17 Aug 2026, 17:30 WIB

CVE-2026-74842

Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function download_image of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument image_url results in server-side request forgery. The attack may be initi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T10:30:11.394Z. Updated 2026-08-18T14:28:17.707Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:28 WIB

Official record

HighPublished 17 Aug 2026, 16:53 WIB

CVE-2026-74845

2100 Technology｜Official Document Management System - Arbitrary File Upload

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T09:53:43.594Z. Updated 2026-08-17T10:18:39.186Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 17:18 WIB

Official record

MedPublished 17 Aug 2026, 15:53 WIB

CVE-2026-49303

CVE-2026-49303

Permission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T08:53:08.380Z. Updated 2026-08-28T17:51:28.679Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 00:51 WIB

Official record

MedPublished 17 Aug 2026, 15:45 WIB

CVE-2026-49301

CVE-2026-49301

Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T08:45:47.172Z. Updated 2026-08-17T10:46:04.022Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 17:46 WIB

Official record

MedPublished 17 Aug 2026, 15:33 WIB

CVE-2026-49305

CVE-2026-49305

Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability may affect availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T08:33:00.983Z. Updated 2026-08-17T10:50:33.203Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 17:50 WIB

Official record