Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 801–820 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 30 Sep 2026, 00:46 WIB

CVE-2026-12345

Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:46:01.811Z. Updated 2026-10-26T00:36:23.425Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 07:36 WIB

Official record

MedPublished 30 Sep 2026, 00:45 WIB

CVE-2026-102719

CVE-2026-102719

Predictable DTLS HelloVerifyRequest Cookie in NetX Secure

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:45:21.609Z. Updated 2026-09-29T18:39:25.824Z.

Showing 801 to 820 of 14934.First page Next page

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:39 WIB

Official record

HighPublished 30 Sep 2026, 00:44 WIB

CVE-2026-102718

CVE-2026-102718

hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:44:43.914Z. Updated 2026-09-29T18:40:08.114Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:40 WIB

Official record

HighPublished 30 Sep 2026, 00:43 WIB

CVE-2026-102716

CVE-2026-102716

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: ```c /* addons/rtsp/nx_rtsp_server.c:2754 */ status = _nx_utility_str…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:43:55.870Z. Updated 2026-09-29T18:41:10.594Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:41 WIB

Official record

HighPublished 30 Sep 2026, 00:43 WIB

CVE-2026-102677

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-cont…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:43:26.960Z. Updated 2026-10-02T12:18:18.477Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:18 WIB

Official record

HighPublished 30 Sep 2026, 00:42 WIB

CVE-2026-102715

mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet

Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores each name in a slot rounded up to a multiple of four: ```c /* addons/mdns/nxd_mdns.c:11436, 11443, 11447 */ memory_len = ((memory_len & 0xFFFFFFFC) + 8) & 0xFFFFFFFF; …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:42:35.719Z. Updated 2026-09-29T18:42:21.812Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:42 WIB

Official record

HighPublished 30 Sep 2026, 00:41 WIB

CVE-2026-102714

CVE-2026-102714

`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns `NX_SUCCESS`. Its zero-length rejection neve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:41:28.517Z. Updated 2026-09-29T18:43:50.148Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:43 WIB

Official record

HighPublished 30 Sep 2026, 00:40 WIB

CVE-2026-102713

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. Two things follow from that one missing check, both…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:40:40.067Z. Updated 2026-09-29T18:44:38.207Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:44 WIB

Official record

HighPublished 30 Sep 2026, 00:39 WIB

CVE-2026-102712

CVE-2026-102712

On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:39:31.083Z. Updated 2026-09-29T21:01:58.481Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 04:01 WIB

Official record

MedPublished 30 Sep 2026, 00:38 WIB

CVE-2026-102711

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_txm_module_manager_in_place_load` — APIs that take ONLY a base pointer, no image length, so every size/offset field in `TXM_MODULE_PREAMBLE` is fully attacker-trus…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:38:22.171Z. Updated 2026-09-29T21:01:58.257Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 04:01 WIB

Official record

CritPublished 30 Sep 2026, 00:37 WIB

CVE-2026-102710

CVE-2026-102710

Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_EVENT_TRACE`. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it directly…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:37:04.556Z. Updated 2026-09-30T20:38:23.363Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:38 WIB

Official record

HighPublished 30 Sep 2026, 00:36 WIB

CVE-2026-102709

CVE-2026-102709

Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they referen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:36:17.135Z. Updated 2026-09-30T20:39:09.361Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:39 WIB

Official record

HighPublished 30 Sep 2026, 00:32 WIB

CVE-2026-102762

CVE-2026-102762

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbound network traffic on t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:32:48.508Z. Updated 2026-09-30T20:39:47.581Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:39 WIB

Official record

UnscoredPublished 30 Sep 2026, 00:32 WIB

CVE-2026-95305

CVE-2026-95305

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:32:01.606Z. Updated 2026-09-29T18:38:06.937Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:38 WIB

Official record

UnscoredPublished 30 Sep 2026, 00:32 WIB

CVE-2026-95364

CVE-2026-95364

Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:32:01.364Z. Updated 2026-09-29T18:38:52.080Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:38 WIB

Official record

UnscoredPublished 30 Sep 2026, 00:32 WIB

CVE-2026-95340

CVE-2026-95340

Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:32:01.120Z. Updated 2026-09-30T16:50:51.375Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:50 WIB

Official record

UnscoredPublished 30 Sep 2026, 00:32 WIB

CVE-2026-95328

CVE-2026-95328

Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:32:00.879Z. Updated 2026-09-29T18:08:37.672Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 01:08 WIB

Official record

UnscoredPublished 30 Sep 2026, 00:32 WIB

CVE-2026-95316

CVE-2026-95316

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:32:00.646Z. Updated 2026-09-29T19:15:21.829Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:15 WIB

Official record

UnscoredPublished 30 Sep 2026, 00:32 WIB

CVE-2026-95296

CVE-2026-95296

Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:32:00.378Z. Updated 2026-09-29T19:16:09.711Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 02:16 WIB

Official record

UnscoredPublished 30 Sep 2026, 00:32 WIB

CVE-2026-95342

CVE-2026-95342

Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T17:32:00.150Z. Updated 2026-09-30T16:49:15.402Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 23:49 WIB

Official record