Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 701–720 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 28 Oct 2026, 19:56 WIB

CVE-2026-55369

Waline login accepts a non-string email as a match-all MongoDB query

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as {"$ne": null}), the Mong…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:56:15.822Z. Updated 2026-10-28T12:56:15.822Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:56 WIB

Official record

CritPublished 28 Oct 2026, 19:55 WIB

CVE-2026-115904

Topluyo Desktop for Linux has an OS Command Injection issue

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary op…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 701 to 720 of 16156.First page Next page

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:55:04.432Z. Updated 2026-10-28T12:55:04.432Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:55 WIB

Official record

MedPublished 28 Oct 2026, 19:39 WIB

CVE-2026-93515

.Org Server Present Extension Use-After-Free

A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:39:44.890Z. Updated 2026-10-28T12:39:44.890Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:39 WIB

Official record

LowPublished 28 Oct 2026, 19:37 WIB

CVE-2026-21830

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:37:35.527Z. Updated 2026-10-28T12:37:35.527Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:37 WIB

Official record

HighPublished 28 Oct 2026, 19:34 WIB

CVE-2026-118037

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host proces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:34:09.534Z. Updated 2026-10-28T12:34:09.534Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:34 WIB

Official record

HighPublished 28 Oct 2026, 19:33 WIB

CVE-2026-118036

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:33:04.373Z. Updated 2026-10-28T12:33:04.373Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:33 WIB

Official record

HighPublished 28 Oct 2026, 19:31 WIB

CVE-2026-118035

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:31:56.249Z. Updated 2026-10-28T12:31:56.249Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:31 WIB

Official record

HighPublished 28 Oct 2026, 19:30 WIB

CVE-2026-118040

Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:30:41.623Z. Updated 2026-10-28T12:30:41.623Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:30 WIB

Official record

HighPublished 28 Oct 2026, 19:29 WIB

CVE-2026-118039

XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:29:35.667Z. Updated 2026-10-28T12:29:35.667Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:29 WIB

Official record

HighPublished 28 Oct 2026, 19:27 WIB

CVE-2026-118038

Path Traversal in Telerik Document Processing Libraries AI Agent Tools

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to overwrite such files w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:27:47.560Z. Updated 2026-10-28T12:27:47.560Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:27 WIB

Official record

MedPublished 28 Oct 2026, 19:26 WIB

CVE-2026-67077

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or unauthorized actions through th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:26:30.628Z. Updated 2026-10-28T12:26:30.628Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:26 WIB

Official record

MedPublished 28 Oct 2026, 19:25 WIB

CVE-2026-67079

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker to embed the application within a malicious web page or iframe and trick users into performing unintended actions, potentially leading to unauthorized transactions or changes to their accounts.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:25:55.234Z. Updated 2026-10-28T12:25:55.234Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:25 WIB

Official record

MedPublished 28 Oct 2026, 19:25 WIB

CVE-2026-67080

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths, potentially facilitating further attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:25:19.455Z. Updated 2026-10-28T12:25:19.455Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:25 WIB

Official record

HighPublished 28 Oct 2026, 19:24 WIB

CVE-2026-67073

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:24:30.101Z. Updated 2026-10-28T12:24:30.101Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:24 WIB

Official record

CritPublished 28 Oct 2026, 19:22 WIB

CVE-2026-67074

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:22:54.795Z. Updated 2026-10-28T12:22:54.795Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:22 WIB

Official record

HighPublished 28 Oct 2026, 18:56 WIB

CVE-2026-102790

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T11:56:12.050Z. Updated 2026-10-28T11:56:12.050Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 18:56 WIB

Official record

MedPublished 28 Oct 2026, 18:55 WIB

CVE-2026-81472

CVE-2026-81472

Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T11:55:34.088Z. Updated 2026-10-29T10:45:43.551Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

CritPublished 28 Oct 2026, 18:55 WIB

CVE-2026-114278

Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T11:55:05.600Z. Updated 2026-10-28T11:55:05.600Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 18:55 WIB

Official record

MedPublished 28 Oct 2026, 18:53 WIB

CVE-2026-102799

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T11:53:05.596Z. Updated 2026-10-28T11:53:05.596Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 18:53 WIB

Official record

HighPublished 28 Oct 2026, 18:26 WIB

CVE-2026-118485

Axel Download Accelerator Path Traversal via URL Filename Decoding

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T11:26:59.053Z. Updated 2026-10-28T11:26:59.053Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 18:26 WIB

Official record