Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 761–780 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 27 Mar 2026, 06:11 WIB

CVE-2026-4904

Tenda AC5 POST Request setcfm formSetCfm stack-based overflow

A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. Such manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T23:11:07.350Z. Updated 2026-03-27T20:08:51.398Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 03:08 WIB

Official record

CritPublished 27 Mar 2026, 05:43 WIB

CVE-2026-33897

Incus vulnerable to arbitrary file read and write through pongo templates

Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary read or writes as root on the host server. Incus allows for pongo2 templates within instances which can be used at various times in the instance lifecycle to template files inside of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 761 to 780 of 6236.First page Next page

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T22:43:31.392Z. Updated 2026-03-27T20:02:55.502Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 03:02 WIB

Official record

MedPublished 27 Mar 2026, 05:40 WIB

CVE-2026-33743

Incus vulnerable to denial of source through crafted bucket backup file

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket backup can be used by an user with access to Incus' storage bucket feature to crash the Incus daemon. Repeated use of this attack can be used to keep the server offline causing a denial of service of the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T22:40:07.499Z. Updated 2026-03-27T13:53:39.299Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 20:53 WIB

Official record

MedPublished 27 Mar 2026, 05:37 WIB

CVE-2026-33711

Incus vulnerable to local privilege escalation through VM screenshot path

Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T22:37:29.746Z. Updated 2026-03-27T20:00:18.358Z.

CVSS4.7v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 03:00 WIB

Official record

MedPublished 27 Mar 2026, 05:32 WIB

CVE-2026-33542

Incus does not verify combined fingerprint when downloading images from simplestreams servers

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T22:32:13.733Z. Updated 2026-03-30T11:47:37.934Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 18:47 WIB

Official record

HighPublished 27 Mar 2026, 05:30 WIB

CVE-2026-34352

CVE-2026-34352

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T22:30:46.928Z. Updated 2026-06-04T14:57:10.753Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated04 Jun 2026, 21:57 WIB

Official record

HighPublished 27 Mar 2026, 05:30 WIB

CVE-2026-4903

Tenda AC5 POST Request QuickIndex formQuickIndex memory corruption

A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. This manipulation of the argument PPPOEPassword causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T22:30:18.420Z. Updated 2026-03-27T20:00:27.001Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 03:00 WIB

Official record

HighPublished 27 Mar 2026, 05:30 WIB

CVE-2026-4902

Tenda AC5 POST Request addressNat fromAddressNat memory corruption

A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addressNat of the component POST Request Handler. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T22:30:14.537Z. Updated 2026-03-27T13:54:48.568Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 20:54 WIB

Official record

MedPublished 27 Mar 2026, 04:56 WIB

CVE-2026-4900

code-projects Online Food Ordering System localhost.sql privilege escalation

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:56:46.312Z. Updated 2026-03-30T11:46:20.001Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 18:46 WIB

Official record

MedPublished 27 Mar 2026, 04:56 WIB

CVE-2026-4899

code-projects Online Food Ordering System food.php cross site scripting

A security flaw has been discovered in code-projects Online Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /dbfood/food.php. The manipulation of the argument cuisines results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:56:43.372Z. Updated 2026-03-27T11:29:13.257Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 18:29 WIB

Official record

HighPublished 27 Mar 2026, 04:54 WIB

CVE-2026-33686

Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:54:25.294Z. Updated 2026-03-27T13:59:50.752Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 20:59 WIB

Official record

HighPublished 27 Mar 2026, 04:48 WIB

CVE-2025-12805

Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicy

A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the llama-stack service endpoint. As a result, a user in one namespace can a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:48:16.762Z. Updated 2026-03-31T03:55:34.790Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 10:55 WIB

Official record

HighPublished 27 Mar 2026, 04:47 WIB

CVE-2026-33687

Sharp has Unrestricted File Upload via Client-Controlled Validation Rules

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within the `ApiFormUploadController` accepts a client-controlled `validation_rule…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:47:55.573Z. Updated 2026-03-27T20:28:53.385Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 03:28 WIB

Official record

MedPublished 27 Mar 2026, 04:45 WIB

CVE-2026-33682

Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure)

Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.0 running on Windows hosts have an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. The vulnerability arises from improper validation of attacker-supplied filesystem paths. In certain…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:45:05.616Z. Updated 2026-03-27T20:00:36.574Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 03:00 WIB

Official record

LowPublished 27 Mar 2026, 04:42 WIB

CVE-2026-33674

PrestaShop: Improper Use of Validation Framework

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 improperly use the validation framework. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available.

Excerpt language: en.

Severity low: primary CNA CVSS 2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:42:33.590Z. Updated 2026-03-30T11:44:22.497Z.

CVSS2v3.1KEVNot listedEPSSPresentUpdated30 Mar 2026, 18:44 WIB

Official record

HighPublished 27 Mar 2026, 04:41 WIB

CVE-2026-33673

PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotect…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:41:13.249Z. Updated 2026-03-27T20:27:40.683Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 03:27 WIB

Official record

HighPublished 27 Mar 2026, 04:39 WIB

CVE-2026-28377

S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to william_goodfellow for reporting this vulnerability.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:39:46.928Z. Updated 2026-08-27T17:22:34.956Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:22 WIB

Official record

MedPublished 27 Mar 2026, 04:39 WIB

CVE-2026-33672

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can referen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:39:16.362Z. Updated 2026-03-27T13:58:41.846Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 20:58 WIB

Official record

HighPublished 27 Mar 2026, 04:20 WIB

CVE-2026-33671

Picomatch has a ReDoS vulnerability via extglob quantifiers

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:20:48.191Z. Updated 2026-03-27T20:00:45.351Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 03:00 WIB

Official record

MedPublished 27 Mar 2026, 04:17 WIB

CVE-2026-0748

Access bypass in Drupal 7 i18n_node translation UI

In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T21:17:37.769Z. Updated 2026-03-27T13:55:09.117Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 20:55 WIB

Official record