Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 81–100 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 01 Sep 2026, 01:57 WIB

CVE-2026-14696

Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion

When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bridge/bridge_input.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called eth_bridge_handle_locally() and r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:57:06.627Z. Updated 2026-09-01T14:01:28.688Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:01 WIB

Official record

MedPublished 01 Sep 2026, 01:52 WIB

CVE-2026-53508

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 81 to 100 of 12259.First page Next page

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:52:12.213Z. Updated 2026-08-31T18:58:08.849Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:58 WIB

Official record

HighPublished 01 Sep 2026, 01:46 WIB

CVE-2026-53553

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:46:52.095Z. Updated 2026-08-31T19:35:12.871Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 02:35 WIB

Official record

CritPublished 01 Sep 2026, 01:46 WIB

CVE-2026-53552

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the call…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:46:41.957Z. Updated 2026-09-01T14:59:24.165Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:59 WIB

Official record

MedPublished 01 Sep 2026, 01:45 WIB

CVE-2026-82821

FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference

A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amf_object_get of the file src/amf.c of the component AMF Object Parsing. This manipulation causes null pointer dereference. The attack may be initiated remotely. The exploit has been publicly disclosed and may be util…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:45:09.107Z. Updated 2026-08-31T19:00:49.098Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 02:00 WIB

Official record

MedPublished 01 Sep 2026, 01:45 WIB

CVE-2026-14368

Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if (string_length > buflen), which accepts a string whose length is exactly buflen. After memcpy() fills the whole buffer, buf[st…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:45:07.165Z. Updated 2026-09-01T14:02:46.625Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:02 WIB

Official record

HighPublished 01 Sep 2026, 01:36 WIB

CVE-2026-83497

Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:36:30.615Z. Updated 2026-09-01T14:03:26.045Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:03 WIB

Official record

MedPublished 01 Sep 2026, 01:30 WIB

CVE-2026-82820

FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow

A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:30:08.737Z. Updated 2026-09-01T18:10:42.105Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 01:10 WIB

Official record

LowPublished 01 Sep 2026, 01:24 WIB

CVE-2023-31308

CVE-2023-31308

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read.

Excerpt language: en.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:24:10.786Z. Updated 2026-09-01T14:04:30.336Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:04 WIB

Official record

HighPublished 01 Sep 2026, 01:17 WIB

CVE-2026-72001

Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:17:17.932Z. Updated 2026-10-01T15:20:26.134Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:20 WIB

Official record

MedPublished 01 Sep 2026, 01:15 WIB

CVE-2026-82818

dibo-software diboot Tenant Resource Assignment resource access control

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched remotely. The exploit ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:15:08.648Z. Updated 2026-08-31T18:48:05.994Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:48 WIB

Official record

MedPublished 01 Sep 2026, 01:15 WIB

CVE-2023-20511

CVE-2023-20511

Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potentially leading to arbitrary code execution.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:15:06.410Z. Updated 2026-09-01T14:46:10.328Z.

CVSS6.4v3.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:46 WIB

Official record

LowPublished 01 Sep 2026, 01:13 WIB

CVE-2026-14367

I3C IBI work-node free-list data race between ISR and workqueue thread

The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization. The allocation helpers (i3c_ibi_work_enqueue, i3c_ibi_work_enqueue_target_irq, i3c_ibi_work_enqueue_hotjoin, i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:13:15.626Z. Updated 2026-09-01T14:05:04.912Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:05 WIB

Official record

MedPublished 01 Sep 2026, 01:00 WIB

CVE-2026-82817

dibo-software diboot Tenant Administrator Management API admin access control

A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiated remotely. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:00:09.717Z. Updated 2026-09-02T14:08:35.275Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 21:08 WIB

Official record

MedPublished 01 Sep 2026, 00:57 WIB

CVE-2026-79743

MCPHub: Path Traversal via Malicious MCPB Manifest Name

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest is directly concatenated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:57:01.176Z. Updated 2026-08-31T18:39:39.736Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:39 WIB

Official record

HighPublished 01 Sep 2026, 00:56 WIB

CVE-2026-79744

MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:56:38.995Z. Updated 2026-08-31T18:49:37.857Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:49 WIB

Official record

HighPublished 01 Sep 2026, 00:56 WIB

CVE-2026-79745

MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:56:17.622Z. Updated 2026-09-02T14:06:49.777Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 21:06 WIB

Official record

HighPublished 01 Sep 2026, 00:55 WIB

CVE-2026-79746

MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' (or 'custom') is used against a group route, isBearerKeyAllowedForRequest grants access t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:55:43.528Z. Updated 2026-09-01T14:59:30.891Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:59 WIB

Official record

HighPublished 01 Sep 2026, 00:55 WIB

CVE-2026-79747

MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue server-side requests to it, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:55:20.953Z. Updated 2026-08-31T19:35:58.635Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 02:35 WIB

Official record

CritPublished 01 Sep 2026, 00:55 WIB

CVE-2026-79748

MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations and then immediately spa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:55:08.740Z. Updated 2026-08-31T18:40:47.698Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:40 WIB

Official record