Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6361–6380 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 16 Aug 2026, 20:14 WIB

CVE-2026-74787

Scriban before 7.0.0 Uncontrolled Recursion via object.to_json

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:12.485Z. Updated 2026-08-18T14:07:14.547Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:07 WIB

Official record

HighPublished 16 Aug 2026, 20:14 WIB

CVE-2026-74786

Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassed because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call and StringBuilderOutput enforces no cumulative out…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 6361 to 6380 of 12259.First page Next page

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:11.837Z. Updated 2026-08-17T17:37:43.578Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 00:37 WIB

Official record

HighPublished 16 Aug 2026, 20:14 WIB

CVE-2026-74785

Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:11.187Z. Updated 2026-08-17T15:34:11.110Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:34 WIB

Official record

HighPublished 16 Aug 2026, 20:14 WIB

CVE-2026-74784

Scriban before 7.2.0 Denial of Service via array.insert_at

Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:10.514Z. Updated 2026-08-17T16:04:51.852Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:04 WIB

Official record

HighPublished 16 Aug 2026, 20:14 WIB

CVE-2026-74783

Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:09.444Z. Updated 2026-09-30T17:20:28.712Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 16 Aug 2026, 20:14 WIB

CVE-2026-73062

Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication

Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing reso…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:08.592Z. Updated 2026-10-08T15:24:38.623Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

CritPublished 16 Aug 2026, 20:14 WIB

CVE-2026-73061

Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:07.946Z. Updated 2026-10-08T15:24:38.118Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

HighPublished 16 Aug 2026, 20:14 WIB

CVE-2026-73060

Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:07.295Z. Updated 2026-09-30T17:20:25.286Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 16 Aug 2026, 20:14 WIB

CVE-2026-73059

stoatchat before 0.15.0 Permission Bypass via message_fetch

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history res…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:06.644Z. Updated 2026-08-17T16:05:00.655Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:05 WIB

Official record

MedPublished 16 Aug 2026, 20:14 WIB

CVE-2026-73058

stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass

stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:05.977Z. Updated 2026-08-17T16:56:09.974Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:56 WIB

Official record

HighPublished 16 Aug 2026, 20:14 WIB

CVE-2026-73057

stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:05.297Z. Updated 2026-08-18T14:05:03.974Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:05 WIB

Official record

CritPublished 16 Aug 2026, 20:14 WIB

CVE-2026-73056

SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is protected by the applic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:04.660Z. Updated 2026-08-17T18:33:37.963Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 01:33 WIB

Official record

HighPublished 16 Aug 2026, 20:14 WIB

CVE-2024-58375

OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T13:14:03.955Z. Updated 2026-10-08T15:21:10.813Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

CritPublished 16 Aug 2026, 19:51 WIB

CVE-2026-74251

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T12:51:15.857Z. Updated 2026-08-18T08:00:09.543Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 15:00 WIB

Official record

CritPublished 16 Aug 2026, 15:31 WIB

CVE-2024-13784

Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP cha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T08:31:05.764Z. Updated 2026-08-17T19:28:52.167Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:28 WIB

Official record

HighPublished 16 Aug 2026, 15:20 WIB

CVE-2026-74578

crypto: algif_skcipher - force synchronous processing on trees without ctx->state

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_skcipher - force synchronous processing on trees without ctx->state The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv directly into the skcipher request. After io_submit() the socket lock is dropped and the request…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T08:20:32.055Z. Updated 2026-10-16T19:05:57.566Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

MedPublished 16 Aug 2026, 13:38 WIB

CVE-2026-18347

Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, wit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T06:38:09.625Z. Updated 2026-08-17T15:40:02.951Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 22:40 WIB

Official record

MedPublished 16 Aug 2026, 13:38 WIB

CVE-2026-17604

Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T06:38:09.273Z. Updated 2026-08-17T19:28:52.358Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 02:28 WIB

Official record

HighPublished 16 Aug 2026, 13:38 WIB

CVE-2026-13424

Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T06:38:08.903Z. Updated 2026-08-17T16:05:08.753Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:05 WIB

Official record

HighPublished 16 Aug 2026, 13:38 WIB

CVE-2026-17087

WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-16T06:38:08.548Z. Updated 2026-08-17T16:58:30.417Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 23:58 WIB

Official record