Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 861–880 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 25 Apr 2026, 01:53 WIB

CVE-2026-41421

SiYuan Desktop Notification XSS Leads to Electron RCE

SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, SiYuan desktop renders notification messages as raw HTML inside an Electron renderer. The notification route POST /api/notification/pushMsg accepts a user-controlled msg value, forwards it through the backend broadcast layer, and the fronten…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:53:49.983Z. Updated 2026-04-25T01:49:47.322Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated25 Apr 2026, 08:49 WIB

Official record

HighPublished 25 Apr 2026, 01:50 WIB

CVE-2026-41419

4ga Boards: Import Path Traversal Leads to Arbitrary File Read

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an authenticated user with board import privileges to make the server ingest arbitrary host files as board attachments during BOARDS archive import. Once imported, the file can be downloaded through the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 861 to 880 of 5813.First page Next page

Published 2026-04-24T18:50:44.763Z. Updated 2026-04-27T13:35:11.635Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:35 WIB

Official record

MedPublished 25 Apr 2026, 01:49 WIB

CVE-2026-41418

4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server responds immediately (~17ms average). When a valid username/email …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:49:38.599Z. Updated 2026-04-24T19:59:10.069Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated25 Apr 2026, 02:59 WIB

Official record

HighPublished 25 Apr 2026, 01:46 WIB

CVE-2026-41326

Kata Containers: CopyFile Policy Subversion via Symlinks

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an oversight in the CopyFile policy (and perhaps the CopyFile handler) allows untrusted hosts to write to arbitrary locations inside the guest workl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:46:21.993Z. Updated 2026-09-01T12:04:43.177Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 19:04 WIB

Official record

HighPublished 25 Apr 2026, 01:40 WIB

CVE-2026-41416

PJSIP: Asymmetric ptime integer overflow in Media Stream

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected appli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:40:08.349Z. Updated 2026-04-27T13:35:20.030Z.

CVSS8.1v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:35 WIB

Official record

MedPublished 25 Apr 2026, 01:38 WIB

CVE-2026-41415

PJSIP: SIP Multipart CID URI Length Underflow

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Content-ID URI in SIP multipart message body. Insufficient length validation can cause reads beyond the intended buffer bounds. This vulnerability is fixed in 2.17.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:38:36.181Z. Updated 2026-04-24T19:58:40.628Z.

CVSS6.7v4.0KEVNot listedEPSSPresentUpdated25 Apr 2026, 02:58 WIB

Official record

HighPublished 25 Apr 2026, 01:32 WIB

CVE-2026-41414

Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml

Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .github/workflows/pr.yml checks out attacker-controlled fork code and executes it via cargo run, with access to SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN (contents:write). No gates prevent exploitation - any GitHub user can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:32:36.283Z. Updated 2026-04-27T13:45:23.120Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:45 WIB

Official record

CritPublished 25 Apr 2026, 01:29 WIB

CVE-2026-41492

Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:29:40.555Z. Updated 2026-04-24T19:13:03.267Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated25 Apr 2026, 02:13 WIB

Official record

CritPublished 25 Apr 2026, 01:27 WIB

CVE-2026-41327

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a single HTTP POST to /muta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:27:51.477Z. Updated 2026-04-24T19:05:56.125Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated25 Apr 2026, 02:05 WIB

Official record

CritPublished 25 Apr 2026, 01:25 WIB

CVE-2026-41328

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack requires two HTTP POSTs to por…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:25:43.894Z. Updated 2026-04-24T19:57:59.743Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated25 Apr 2026, 02:57 WIB

Official record

HighPublished 25 Apr 2026, 01:21 WIB

CVE-2026-33666

Zserio: Integer Overflow in BitStreamReader on 32-bit platforms

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds check receives the overflowed value and is completely bypassed. The code then reads len bytes (512 MB) from a buffer tha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:21:11.265Z. Updated 2026-04-27T13:46:01.833Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:46 WIB

Official record

HighPublished 25 Apr 2026, 01:18 WIB

CVE-2026-33524

Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:18:02.913Z. Updated 2026-04-27T13:35:28.660Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:35 WIB

Official record

HighPublished 25 Apr 2026, 01:13 WIB

CVE-2026-33662

OP-TEE: RSASSA EMSA- PKCS1-v1_5 underflow in emsa_pkcs1_v1_5_encode()

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. From 3.8.0 to 4.10, in the function emsa_pkcs1_v1_5_encode() in core/drivers/crypto/crypto_api/acipher/rsassa.c, the amount of padding needed, "PS size", is c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:13:28.529Z. Updated 2026-04-24T19:00:51.713Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated25 Apr 2026, 02:00 WIB

Official record

HighPublished 25 Apr 2026, 01:09 WIB

CVE-2026-41907

uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:09:24.744Z. Updated 2026-04-27T13:35:34.363Z.

CVSS8.1v4.0KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:35 WIB

Official record

MedPublished 25 Apr 2026, 01:03 WIB

CVE-2026-42042

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:03:29.924Z. Updated 2026-04-27T17:35:41.883Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 00:35 WIB

Official record

MedPublished 25 Apr 2026, 01:01 WIB

CVE-2026-42039

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:01:30.775Z. Updated 2026-09-10T12:04:56.504Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Sep 2026, 19:04 WIB

Official record

MedPublished 25 Apr 2026, 01:00 WIB

CVE-2026-42036

Axios: HTTP adapter streamed responses bypass maxContentLength

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T18:00:33.121Z. Updated 2026-04-24T18:32:49.313Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated25 Apr 2026, 01:32 WIB

Official record

MedPublished 25 Apr 2026, 00:59 WIB

CVE-2026-42034

Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T17:59:47.802Z. Updated 2026-04-24T18:13:14.474Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated25 Apr 2026, 01:13 WIB

Official record

MedPublished 25 Apr 2026, 00:58 WIB

CVE-2026-42037

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls the .type…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T17:58:16.058Z. Updated 2026-04-27T17:37:06.975Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 00:37 WIB

Official record

MedPublished 25 Apr 2026, 00:57 WIB

CVE-2026-42038

Axios: no_proxy bypass via IP alias allows SSRF

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-24T17:57:26.975Z. Updated 2026-04-27T13:46:32.484Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated27 Apr 2026, 20:46 WIB

Official record