Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 761–780 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 30 Sep 2026, 02:28 WIB

CVE-2026-76727

Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T19:28:41.791Z. Updated 2026-10-01T03:55:35.894Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 10:55 WIB

Official record

HighPublished 30 Sep 2026, 02:28 WIB

CVE-2026-76726

Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint

An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain unauthorized access to re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 761 to 780 of 14934.First page Next page

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T19:28:40.357Z. Updated 2026-10-01T03:55:34.454Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 10:55 WIB

Official record

CritPublished 30 Sep 2026, 02:28 WIB

CVE-2026-76725

Authentication Bypass in a Management Protocol of HPE Networking Instant ON APs

A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of security restrictions, potentially leading to remote code execu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T19:28:39.375Z. Updated 2026-10-01T03:55:33.715Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 10:55 WIB

Official record

CritPublished 30 Sep 2026, 02:28 WIB

CVE-2026-76724

Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T19:28:37.681Z. Updated 2026-10-01T03:55:32.992Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 10:55 WIB

Official record

CritPublished 30 Sep 2026, 02:28 WIB

CVE-2026-76723

Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS

Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T19:28:35.968Z. Updated 2026-10-01T03:55:32.267Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 10:55 WIB

Official record

CritPublished 30 Sep 2026, 02:28 WIB

CVE-2026-76722

Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T19:28:34.471Z. Updated 2026-10-01T03:55:31.535Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 10:55 WIB

Official record

CritPublished 30 Sep 2026, 02:28 WIB

CVE-2026-76721

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T19:28:33.479Z. Updated 2026-09-30T20:11:06.823Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

HighPublished 30 Sep 2026, 02:13 WIB

CVE-2026-61519

Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invitation rights base…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T19:13:13.767Z. Updated 2026-09-30T19:27:52.083Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:27 WIB

Official record

HighPublished 30 Sep 2026, 01:58 WIB

CVE-2026-102831

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:58:03.634Z. Updated 2026-10-02T12:22:58.664Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:22 WIB

Official record

MedPublished 30 Sep 2026, 01:53 WIB

CVE-2026-102830

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a valid plu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:53:19.055Z. Updated 2026-09-29T20:00:25.547Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 03:00 WIB

Official record

CritPublished 30 Sep 2026, 01:46 WIB

CVE-2026-102829

simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it as allowUnsafeEditor. A …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:46:58.476Z. Updated 2026-09-30T19:28:41.888Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:28 WIB

Official record

MedPublished 30 Sep 2026, 01:45 WIB

CVE-2026-102616

risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection. Remote exploitation of t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:45:09.352Z. Updated 2026-09-29T19:59:22.246Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:59 WIB

Official record

CritPublished 30 Sep 2026, 01:43 WIB

CVE-2026-102828

simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled val…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:43:19.086Z. Updated 2026-09-30T20:08:15.246Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:08 WIB

Official record

HighPublished 30 Sep 2026, 01:39 WIB

CVE-2026-102827

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:39:57.688Z. Updated 2026-10-02T12:21:16.544Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:21 WIB

Official record

HighPublished 30 Sep 2026, 01:37 WIB

CVE-2026-102826

simple-git allows command execution through unblocked Git configuration includes

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path cla…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:37:10.490Z. Updated 2026-09-29T19:58:38.849Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:58 WIB

Official record

LowPublished 30 Sep 2026, 01:31 WIB

CVE-2026-102825

Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:31:32.393Z. Updated 2026-09-30T19:29:26.432Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:29 WIB

Official record

MedPublished 30 Sep 2026, 01:27 WIB

CVE-2026-102824

Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malici…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:27:41.650Z. Updated 2026-09-30T20:24:58.381Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:24 WIB

Official record

HighPublished 30 Sep 2026, 01:25 WIB

CVE-2026-102823

russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:25:58.084Z. Updated 2026-10-02T12:20:10.605Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:20 WIB

Official record

LowPublished 30 Sep 2026, 01:23 WIB

CVE-2026-102822

russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic

Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needs_mac() only when MAC selection fails. A remote peer can then send a packet with a decrypted length of zero, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:23:28.061Z. Updated 2026-09-29T19:53:30.291Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:53 WIB

Official record

MedPublished 30 Sep 2026, 01:21 WIB

CVE-2026-102821

Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T18:21:21.858Z. Updated 2026-09-30T19:35:02.962Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:35 WIB

Official record