Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6281–6300 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 17 Aug 2026, 12:30 WIB

CVE-2026-19988

Alaev SEO Tools Extension Popup UI popup.html addDiv cross site scripting

A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T05:30:09.584Z. Updated 2026-08-18T14:25:26.245Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:25 WIB

Official record

HighPublished 17 Aug 2026, 12:28 WIB

CVE-2026-74579

netfilter: nft_payload: fix mask build for partial field offload

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: fix mask build for partial field offload nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match (field_len = 16, priv_len = …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 6281 to 6300 of 12259.First page Next page

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T05:28:27.768Z. Updated 2026-10-16T19:05:57.728Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

MedPublished 17 Aug 2026, 12:15 WIB

CVE-2026-19987

SourceCodester Best Employee Management System Profile exposure of information through directory listing

A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. This affects an unknown function of the file /assets/uploadImage/Profile/. Such manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T05:15:08.914Z. Updated 2026-08-17T15:44:34.704Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:44 WIB

Official record

MedPublished 17 Aug 2026, 12:00 WIB

CVE-2026-19986

Adblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization

A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file contentscript.js of the component Event Listener. This manipulation of the argument yt-anti-adblock-detected causes improper authorization. It is possible to initiat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T05:00:11.528Z. Updated 2026-08-19T15:40:19.864Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 22:40 WIB

Official record

MedPublished 17 Aug 2026, 11:45 WIB

CVE-2026-19984

jkawamoto mcp-florence2 __init__.py get_images server-side request forgery

A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florence2/__init__.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. It i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T04:45:09.899Z. Updated 2026-08-18T13:37:29.712Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:37 WIB

Official record

MedPublished 17 Aug 2026, 11:30 WIB

CVE-2026-19983

GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgradin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T04:30:11.277Z. Updated 2026-08-17T15:29:21.838Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:29 WIB

Official record

MedPublished 17 Aug 2026, 11:15 WIB

CVE-2026-19982

GL.iNet BE9300/MT6000 Firewall-management RPC os command injection

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T04:15:08.101Z. Updated 2026-08-18T14:24:10.126Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:24 WIB

Official record

MedPublished 17 Aug 2026, 11:00 WIB

CVE-2026-19981

GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument swit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T04:00:11.538Z. Updated 2026-08-17T15:47:06.274Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:47 WIB

Official record

MedPublished 17 Aug 2026, 10:45 WIB

CVE-2026-19980

GL.iNet XE3000 Language Update ui.update_langs code injection

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T03:45:07.917Z. Updated 2026-08-19T14:51:26.467Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:51 WIB

Official record

MedPublished 17 Aug 2026, 10:30 WIB

CVE-2026-19979

GL.iNet XE3000 WebDAV Service MOVE authorization

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorizat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T03:30:09.125Z. Updated 2026-08-18T13:37:35.365Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:37 WIB

Official record

MedPublished 17 Aug 2026, 10:15 WIB

CVE-2026-19978

jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection

A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument deviceId/packageName/permission/extras[].key/extras[].valu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T03:15:10.773Z. Updated 2026-08-17T15:27:50.364Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:27 WIB

Official record

CritPublished 17 Aug 2026, 10:00 WIB

CVE-2026-19977

EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T03:00:09.815Z. Updated 2026-08-18T14:18:47.983Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:18 WIB

Official record

MedPublished 17 Aug 2026, 09:45 WIB

CVE-2026-19976

COMFAST CF-N1-S mbox-config sub_44A968 command injection

A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET&section=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T02:45:11.135Z. Updated 2026-08-17T15:52:54.951Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:52 WIB

Official record

LowPublished 17 Aug 2026, 09:30 WIB

CVE-2026-19975

Azuriom CMS Money Transfer ProfileController.php transferMoney toctou

A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The attack may be initiated remotely. A high degree of complexity …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T02:30:10.701Z. Updated 2026-08-19T14:40:00.144Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:40 WIB

Official record

HighPublished 17 Aug 2026, 09:16 WIB

CVE-2026-50602

Planet9 Incorrect Permission Assignment Vulnerability Information

A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background service. The service runs with SYSTEM privileges, while the affected executable grants excessive permissions to non-administrative users. As a result, an authent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T02:16:49.131Z. Updated 2026-08-17T15:55:59.301Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:55 WIB

Official record

MedPublished 17 Aug 2026, 09:15 WIB

CVE-2026-19974

treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication

A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be launched remotely. A high…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T02:15:08.807Z. Updated 2026-08-18T13:37:40.835Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 20:37 WIB

Official record

MedPublished 17 Aug 2026, 09:02 WIB

CVE-2026-50601

Planet9 Hardcoded Credentials Vulnerability Information

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain administrative access t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T02:02:40.508Z. Updated 2026-08-17T15:57:28.016Z.

CVSS6.6v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:57 WIB

Official record

MedPublished 17 Aug 2026, 09:00 WIB

CVE-2026-19973

itsourcecode Hospital Management System viewpaymentreport.php sql injection

A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The exploit has been made pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T02:00:12.346Z. Updated 2026-08-17T15:27:20.418Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:27 WIB

Official record

MedPublished 17 Aug 2026, 08:45 WIB

CVE-2026-19972

itsourcecode Hospital Management System viewpatient.php sql injection

A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation of the argument delid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T01:45:08.964Z. Updated 2026-08-18T14:17:44.595Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:17 WIB

Official record

MedPublished 17 Aug 2026, 08:30 WIB

CVE-2026-19971

LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this disclosure but did not res…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-17T01:30:08.358Z. Updated 2026-08-17T16:03:40.311Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:03 WIB

Official record