Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 701–720 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 28 Aug 2026, 18:00 WIB

CVE-2026-82111

iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal

A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component upload_image. Performing a manipulation of the argument image_path results in path traversal. The attack can be initiated remotely. The exploit is now public an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T11:00:11.287Z. Updated 2026-08-31T18:37:50.593Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:37 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82261

SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. F…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 701 to 720 of 12259.First page Next page

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:44.323Z. Updated 2026-10-08T15:25:32.042Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82260

SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization

SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:43.651Z. Updated 2026-10-08T15:25:31.482Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82259

SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:42.969Z. Updated 2026-10-08T15:25:30.919Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

MedPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82258

SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:42.085Z. Updated 2026-10-08T15:25:30.362Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

MedPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82257

SvelteKit before 2.69.1 Prototype Pollution via File Input

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:41.355Z. Updated 2026-10-08T15:25:29.825Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

MedPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82256

SvelteKit before 2.69.1 Denial of Service via Remote Form

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:40.634Z. Updated 2026-10-08T15:25:29.200Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82255

gitoxide 0.25.4 HTTP Credential Leak via Redirect

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:38.916Z. Updated 2026-09-30T17:20:31.376Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82254

gitoxide before 0.69.0 Denial of Service via gix-pack

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:38.250Z. Updated 2026-08-28T13:59:07.704Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 20:59 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82253

gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this valid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:37.566Z. Updated 2026-08-31T18:34:55.673Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:34 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82252

gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:36.897Z. Updated 2026-08-29T13:38:27.910Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 20:38 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82251

gitoxide before 0.52.1 Path Traversal via Submodule Name

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repositor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:36.185Z. Updated 2026-08-29T13:38:27.250Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 20:38 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82250

gitoxide gix-packetline before 0.21.5 Denial of Service

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:35.517Z. Updated 2026-08-28T15:52:43.900Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:52 WIB

Official record

LowPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82249

gitoxide before 0.38.2 Credential Helper Protocol Field Injection

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:34.825Z. Updated 2026-08-28T15:26:02.245Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 22:26 WIB

Official record

MedPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82248

gitoxide before 0.33.0 Path Traversal via symlink following

gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_is_initially_empty: false) when core.symlinks is true. If a symlink entry (mode 12…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:34.165Z. Updated 2026-08-31T18:32:54.127Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:32 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82247

gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing

gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker control…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:33.476Z. Updated 2026-08-28T14:07:19.207Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 21:07 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82246

Budibase Server before 3.41.3 SSRF via Query Import

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted netw…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:32.768Z. Updated 2026-10-08T15:25:28.615Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82245

Budibase before 3.41.3 Missing Authorization License Management

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/* endpoints to disable premium features and downgrade deployments for…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:32.098Z. Updated 2026-10-08T15:25:27.957Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

CritPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82244

Budibase before 3.41.3 Remote Code Execution via Plugin eval()

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:31.426Z. Updated 2026-10-08T15:25:26.887Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

HighPublished 28 Aug 2026, 17:49 WIB

CVE-2026-82243

Budibase Server before 3.41.3 SSRF with Credential Leakage

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to attacker-controlled servers, gainin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T10:49:30.744Z. Updated 2026-10-08T15:25:26.045Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record