Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 781–800 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 26 Apr 2026, 14:15 WIB

CVE-2026-7026

D-Link DGS-3420 System Information Settings cross site scripting

A vulnerability was determined in D-Link DGS-3420 1.50.018. This issue affects some unknown processing of the component System Information Settings Page. This manipulation of the argument System Name causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T07:15:12.717Z. Updated 2026-04-27T13:31:45.153Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:31 WIB

Official record

MedPublished 26 Apr 2026, 14:00 WIB

CVE-2026-7025

Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 781 to 800 of 5813.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T07:00:17.124Z. Updated 2026-10-27T13:30:00.271Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 20:30 WIB

Official record

MedPublished 26 Apr 2026, 13:45 WIB

CVE-2026-7024

rawchen sims deleteFileServlet Endpoint DeleteFileServlet.java path traversal

A flaw has been found in rawchen sims up to 004f783b1db5ecdfad81c8fdc3b34171211112de. Affected by this issue is some unknown functionality of the file sims-master/src/web/servlet/file/DeleteFileServlet.java of the component deleteFileServlet Endpoint. Executing a manipulation of the argument filename can lead to path t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T06:45:11.009Z. Updated 2026-04-27T12:44:44.454Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 19:44 WIB

Official record

MedPublished 26 Apr 2026, 13:30 WIB

CVE-2026-7023

ByteDance coze-studio databaseTool database_impl.go ExecuteSQL sql injection

A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. The attack can be initiated remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T06:30:15.273Z. Updated 2026-04-27T17:00:29.181Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 00:00 WIB

Official record

MedPublished 26 Apr 2026, 12:45 WIB

CVE-2026-7022

SmythOS sre HTTP Header AgentRuntime.class.ts AgentRuntime improper authentication

A security vulnerability has been detected in SmythOS sre up to 0.0.15. Affected is the function AgentRuntime of the file packages/core/src/subsystems/AgentManager/AgentRuntime.class.ts of the component HTTP Header Handler. Such manipulation of the argument X-DEBUG-RUN/X-DEBUG-INJ leads to improper authentication. It i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T05:45:11.931Z. Updated 2026-04-27T13:52:30.369Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:52 WIB

Official record

MedPublished 26 Apr 2026, 12:30 WIB

CVE-2026-7021

SmythOS sre Connector Service utils.ts information disclosure

A weakness has been identified in SmythOS sre up to 0.0.15. This impacts an unknown function of the file packages/sdk/src/LLM/utils.ts of the component Connector Service. This manipulation of the argument baseURL causes information disclosure. It is possible to initiate the attack remotely. The exploit has been made av…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T05:30:15.403Z. Updated 2026-04-27T13:31:51.415Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:31 WIB

Official record

MedPublished 26 Apr 2026, 11:45 WIB

CVE-2026-7020

Ollama Tensor Model Transfer transfer.go digestToPath path traversal

A security flaw has been discovered in Ollama up to 0.20.2. This affects the function digestToPath of the file x/imagegen/transfer/transfer.go of the component Tensor Model Transfer Handler. The manipulation of the argument digest results in path traversal. The attack may be performed from remote. This attack is charac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T04:45:11.467Z. Updated 2026-05-06T04:55:00.516Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated06 May 2026, 11:55 WIB

Official record

HighPublished 26 Apr 2026, 11:30 WIB

CVE-2026-7019

Tenda F456 P2pListFilter fromP2pListFilter buffer overflow

A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument menufacturer/Go leads to buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T04:30:17.930Z. Updated 2026-04-27T12:43:05.224Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 19:43 WIB

Official record

MedPublished 26 Apr 2026, 10:30 WIB

CVE-2026-7018

Datavane Datavines JWT Token TokenManager.java hard-coded key

A vulnerability was determined in Datavane Datavines up to 13607645e14a4982468cfdbcf75c85cde63bae71. The affected element is an unknown function of the file datavines-core/src/main/java/io/datavines/core/utils/TokenManager.java of the component JWT Token Handler. Executing a manipulation of the argument tokenSecret can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T03:30:20.576Z. Updated 2026-04-27T17:02:44.468Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 00:02 WIB

Official record

MedPublished 26 Apr 2026, 10:15 WIB

CVE-2026-7016

MaxSite CMS ushki Plugin cross site scripting

A vulnerability was found in MaxSite CMS up to 109.3. Impacted is an unknown function of the component ushki Plugin. Performing a manipulation of the argument f_ushka_new/f_ushk results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. Upgrading …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T03:15:16.201Z. Updated 2026-04-27T13:51:40.053Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:51 WIB

Official record

HighPublished 26 Apr 2026, 09:48 WIB

CVE-2026-42255

CVE-2026-42255

Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T02:48:44.810Z. Updated 2026-04-27T13:31:57.425Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:31 WIB

Official record

MedPublished 26 Apr 2026, 09:45 WIB

CVE-2026-7015

MaxSite CMS Guestbook Plugin cross site scripting

A vulnerability has been found in MaxSite CMS up to 109.3. This issue affects some unknown processing of the component Guestbook Plugin. Such manipulation of the argument f_text/f_slug/f_limit/f_email leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T02:45:13.451Z. Updated 2026-04-27T13:33:41.813Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:33 WIB

Official record

MedPublished 26 Apr 2026, 09:38 WIB

CVE-2026-42254

CVE-2026-42254

Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T02:38:41.261Z. Updated 2026-04-27T13:33:50.961Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:33 WIB

Official record

MedPublished 26 Apr 2026, 09:30 WIB

CVE-2026-7014

MaxSite CMS down_count Plugin cross site scripting

A flaw has been found in MaxSite CMS up to 109.3. This vulnerability affects unknown code of the component down_count Plugin. This manipulation of the argument f_file/f_prefix causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 109.4 is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T02:30:20.930Z. Updated 2026-04-27T13:24:06.084Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:24 WIB

Official record

MedPublished 26 Apr 2026, 09:00 WIB

CVE-2026-7013

MaxSite CMS mail_send Plugin cross site scripting

A security vulnerability has been detected in MaxSite CMS up to 109.3. Affected by this issue is some unknown functionality of the component mail_send Plugin. The manipulation of the argument f_subject/f_files/f_from leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T02:00:20.341Z. Updated 2026-04-27T12:41:59.493Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 19:41 WIB

Official record

MedPublished 26 Apr 2026, 08:15 WIB

CVE-2026-7012

MaxSite CMS Redirect Plugin cross site scripting

A vulnerability was detected in MaxSite CMS up to 109.3. This affects an unknown part of the component Redirect Plugin. The manipulation of the argument f_all/f_all404 results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 109.4 is able to m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T01:15:16.588Z. Updated 2026-04-27T17:04:16.592Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Apr 2026, 00:04 WIB

Official record

MedPublished 26 Apr 2026, 07:30 WIB

CVE-2026-7011

MaxSite CMS Antispam Plugin plugin_antispam cross site scripting

A weakness has been identified in MaxSite CMS up to 109.3. Affected by this vulnerability is an unknown functionality of the file /admin/plugin_antispam of the component Antispam Plugin. Executing a manipulation of the argument f_logging_file can lead to cross site scripting. It is possible to launch the attack remotel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-26T00:30:20.988Z. Updated 2026-04-27T13:50:27.566Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:50 WIB

Official record

MedPublished 26 Apr 2026, 04:30 WIB

CVE-2026-7002

KLiK SocialMediaWebsite Private Message get_message_ajax.php sql injection

A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1. This vulnerability affects unknown code of the file /includes/get_message_ajax.php of the component Private Message Handler. Executing a manipulation of the argument c_id can lead to sql injection. It is possible to launch the attack remotely.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-25T21:30:16.071Z. Updated 2026-04-27T13:33:56.667Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:33 WIB

Official record

MedPublished 26 Apr 2026, 04:15 WIB

CVE-2026-7001

Datacom DM4100 Ethernet Configuration cross site scripting

A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709. This affects an unknown part of the component Ethernet Configuration Page. Performing a manipulation of the argument Name results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-25T21:15:13.581Z. Updated 2026-04-27T13:29:36.608Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:29 WIB

Official record

MedPublished 26 Apr 2026, 04:00 WIB

CVE-2026-7000

Datacom DM4100 VLAN Page cross site scripting

A vulnerability has been found in Datacom DM4100 1.3.6.1.4.1.3709. Affected by this issue is some unknown functionality of the component VLAN Page. Such manipulation of the argument VLAN Name leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-25T21:00:24.121Z. Updated 2026-04-27T12:39:14.369Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 19:39 WIB

Official record