Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 841–860 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99104

sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scx_bypass() claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates only the depth to the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:23.729Z. Updated 2026-10-28T10:34:23.729Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99103

workqueue: Fix unbound pool lifetime for pending pwqs

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq(): BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce00…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 841 to 860 of 16156.First page Next page

Published 2026-10-28T10:34:22.945Z. Updated 2026-10-28T10:34:22.945Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99102

ntfs: take invalidate_lock in ntfs_setattr_size()

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate_lock in ntfs_setattr_size() ntfs_setattr_size() updates i_size and resizes the on-disk attribute without holding mapping->invalidate_lock. Page faults take the lock shared, so a fault racing the resize can resolve a VCN against…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:17.224Z. Updated 2026-10-28T10:34:17.224Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

UnscoredPublished 28 Oct 2026, 17:34 WIB

CVE-2026-99101

ntfs: move attribute payload before shrinking its record

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfs_new_attr_flags() resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is cleared. Shrinking …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:34:16.583Z. Updated 2026-10-28T10:34:16.583Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:34 WIB

Official record

HighPublished 28 Oct 2026, 17:33 WIB

CVE-2026-110541

CVE-2026-110541

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Comman…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:33:32.058Z. Updated 2026-10-29T03:57:05.465Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 10:57 WIB

Official record

LowPublished 28 Oct 2026, 17:33 WIB

CVE-2026-101272

Incorrect session validation for API-created shredder exports

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly genera…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:33:31.936Z. Updated 2026-10-28T10:33:31.936Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:33 WIB

Official record

MedPublished 28 Oct 2026, 17:31 WIB

CVE-2026-101274

CVE-2026-101274

When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code`…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:31:23.485Z. Updated 2026-10-28T10:31:23.485Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:31 WIB

Official record

HighPublished 28 Oct 2026, 17:30 WIB

CVE-2026-110540

CVE-2026-110540

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:30:13.735Z. Updated 2026-10-28T10:30:13.735Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:30 WIB

Official record

MedPublished 28 Oct 2026, 17:29 WIB

CVE-2026-101273

Giftcard enumeration

Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:29:06.786Z. Updated 2026-10-28T10:29:06.786Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:29 WIB

Official record

CritPublished 28 Oct 2026, 17:26 WIB

CVE-2026-103792

CVE-2026-103792

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:26:41.330Z. Updated 2026-10-29T10:45:43.691Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

HighPublished 28 Oct 2026, 17:22 WIB

CVE-2026-103779

CVE-2026-103779

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privileged attacker with remote …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:22:38.482Z. Updated 2026-10-29T03:57:07.897Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 10:57 WIB

Official record

HighPublished 28 Oct 2026, 17:20 WIB

CVE-2026-112198

Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App

XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML fil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:20:06.729Z. Updated 2026-10-28T10:21:56.415Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:21 WIB

Official record

CritPublished 28 Oct 2026, 17:18 WIB

CVE-2026-103799

CVE-2026-103799

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:18:59.100Z. Updated 2026-10-28T10:18:59.100Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:18 WIB

Official record

CritPublished 28 Oct 2026, 17:17 WIB

CVE-2026-112197

Missing Authentication for Critical Function in Tactis' NoviGest Desktop App

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:17:12.401Z. Updated 2026-10-28T10:17:12.401Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:17 WIB

Official record

CritPublished 28 Oct 2026, 17:14 WIB

CVE-2026-103780

CVE-2026-103780

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:14:39.716Z. Updated 2026-10-29T10:45:43.826Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

MedPublished 28 Oct 2026, 17:12 WIB

CVE-2026-87879

CVE-2026-87879

Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:12:07.066Z. Updated 2026-10-28T10:12:07.066Z.

CVSS5.9v3.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:12 WIB

Official record

MedPublished 28 Oct 2026, 17:11 WIB

CVE-2026-87878

CVE-2026-87878

Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 42587.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:11:49.731Z. Updated 2026-10-29T10:45:43.972Z.

CVSS6.3v3.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

HighPublished 28 Oct 2026, 17:11 WIB

CVE-2026-87102

CVE-2026-87102

Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:11:31.104Z. Updated 2026-10-29T10:45:44.118Z.

CVSS7.4v3.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

LowPublished 28 Oct 2026, 17:11 WIB

CVE-2026-87100

CVE-2026-87100

Protection mechanism failure due to missing binary hardening in Linux executables. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 42587.

Excerpt language: en.

Severity low: primary CNA CVSS 3.6 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:11:11.891Z. Updated 2026-10-28T10:11:11.891Z.

CVSS3.6v3.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:11 WIB

Official record

MedPublished 28 Oct 2026, 17:10 WIB

CVE-2026-87099

CVE-2026-87099

Cross-site scripting (XSS) vulnerability due to improper input validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:10:24.198Z. Updated 2026-10-28T10:10:24.198Z.

CVSS5.7v3.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:10 WIB

Official record