Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 801–820 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

MedPublished 27 Mar 2026, 03:34 WIB

CVE-2026-33619

PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains a server-side request forgery issue in the optional scheduler's webhook delivery path. When a task is submitted to `POST /tasks` with a user-controlled `callbackUrl`, the v0.8.3 scheduler sends an ou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:34:01.661Z. Updated 2026-03-30T11:34:43.286Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated30 Mar 2026, 18:34 WIB

Official record

MedPublished 27 Mar 2026, 03:32 WIB

CVE-2026-33545

MobSF has SQL Injection in its SQLite Database Viewer Utils

MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses Mob…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 801 to 820 of 6236.First page Next page

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:32:21.357Z. Updated 2026-03-27T20:20:44.755Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 03:20 WIB

Official record

MedPublished 27 Mar 2026, 03:30 WIB

CVE-2026-33635

iCalendar has ICS injection via unsanitized URI property values

iCalendar is a Ruby library for dealing with iCalendar files in the iCalendar format defined by RFC-5545. Starting in version 2.0.0 and prior to version 2.12.2, .ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:30:43.696Z. Updated 2026-03-30T11:33:48.950Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated30 Mar 2026, 18:33 WIB

Official record

MedPublished 27 Mar 2026, 03:27 WIB

CVE-2026-33541

TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 34, a flaw in TSPortal allowed attackers to create arbitrary user records in the database by abusing validation logic. While validation correctly …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:27:05.840Z. Updated 2026-03-27T20:01:35.174Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Mar 2026, 03:01 WIB

Official record

MedPublished 27 Mar 2026, 03:25 WIB

CVE-2026-33738

Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)

Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored without HTML sanitization and rendered using `{!! $item->summary !!}` (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The `/feed` endpoint is publicly accessible without authenticatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:25:44.648Z. Updated 2026-03-27T13:55:55.702Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 20:55 WIB

Official record

UnscoredPublished 27 Mar 2026, 03:10 WIB

CVE-2026-4393

Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.2.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:10:40.090Z. Updated 2026-03-30T14:54:29.743Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:54 WIB

Official record

UnscoredPublished 27 Mar 2026, 03:10 WIB

CVE-2026-4933

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing.This issue affects Unpublished Node Permissions: from 0.0.0 before 1.7.0.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:10:26.886Z. Updated 2026-03-30T14:54:36.334Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:54 WIB

Official record

UnscoredPublished 27 Mar 2026, 03:10 WIB

CVE-2026-3573

AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028

Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:10:13.350Z. Updated 2026-03-30T14:54:43.980Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:54 WIB

Official record

LowPublished 27 Mar 2026, 03:06 WIB

CVE-2026-0965

Libssh: libssh: denial of service via improper configuration file handling

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dang…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:06:33.336Z. Updated 2026-09-01T12:10:14.607Z.

CVSS3.3v3.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 19:10 WIB

Official record

LowPublished 27 Mar 2026, 03:06 WIB

CVE-2026-0967

Libssh: libssh: denial of service via inefficient regular expression processing

A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Den…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.2 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:06:30.707Z. Updated 2026-09-01T12:10:17.319Z.

CVSS2.2v3.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 19:10 WIB

Official record

LowPublished 27 Mar 2026, 03:06 WIB

CVE-2026-0968

Libssh: libssh: denial of service due to malformed sftp message

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:06:29.554Z. Updated 2026-10-16T10:12:51.217Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 17:12 WIB

Official record

MedPublished 27 Mar 2026, 03:06 WIB

CVE-2026-0964

Libssh: improper sanitation of paths received from scp servers

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:06:28.871Z. Updated 2026-09-01T11:54:48.544Z.

CVSS5v3.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 18:54 WIB

Official record

MedPublished 27 Mar 2026, 03:06 WIB

CVE-2026-0966

Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()

A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_P…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:06:28.313Z. Updated 2026-09-01T11:54:52.805Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 18:54 WIB

Official record

MedPublished 27 Mar 2026, 03:06 WIB

CVE-2026-21724

Missing Protected-field Authorization in Provisioning Contact Points API

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:06:18.829Z. Updated 2026-08-27T17:22:23.621Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:22 WIB

Official record

MedPublished 27 Mar 2026, 03:05 WIB

CVE-2026-33375

Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:05:52.564Z. Updated 2026-08-27T17:22:41.503Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2026, 00:22 WIB

Official record

LowPublished 27 Mar 2026, 03:04 WIB

CVE-2026-33644

Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs

Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` can be bypassed using DNS rebinding. The IP validation check (line 86-89) only activates when the hostname is an IP address. When a domain name is used, `filter_var($host, FILTER_VALIDATE_IP)` returns …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:04:18.728Z. Updated 2026-03-30T11:30:40.546Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Mar 2026, 18:30 WIB

Official record

UnscoredPublished 27 Mar 2026, 03:04 WIB

CVE-2026-3532

OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027

Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:04:03.160Z. Updated 2026-03-27T13:53:59.637Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2026, 20:53 WIB

Official record

UnscoredPublished 27 Mar 2026, 03:03 WIB

CVE-2026-3531

OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:03:48.873Z. Updated 2026-03-30T14:54:51.550Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:54 WIB

Official record

UnscoredPublished 27 Mar 2026, 03:03 WIB

CVE-2026-3530

OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:03:39.756Z. Updated 2026-03-30T14:54:58.296Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 21:54 WIB

Official record

UnscoredPublished 27 Mar 2026, 03:03 WIB

CVE-2026-3529

Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (XSS).This issue affects Google Analytics GA4: from 0.0.0 before 1.1.14.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T20:03:28.917Z. Updated 2026-03-27T18:09:00.611Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Mar 2026, 01:09 WIB

Official record