Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 81–100 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

MedPublished 01 Oct 2026, 03:05 WIB

CVE-2026-102090

Kiteworks Core content injection

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relyi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:05:32.183Z. Updated 2026-10-01T13:37:09.360Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:05 WIB

CVE-2026-102098

Kiteworks Core SQL Injection

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service. Exploitation requires an …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 81 to 100 of 14934.First page Next page

Published 2026-09-30T20:05:28.045Z. Updated 2026-10-01T13:37:09.488Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:05 WIB

CVE-2026-102089

Kiteworks Email Protection Gateway path traversal

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:05:02.985Z. Updated 2026-10-01T13:37:09.618Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:03 WIB

CVE-2026-102996

pypdf: Possible large memory usage when parsing font data

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consum…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:03:55.880Z. Updated 2026-09-30T20:48:39.148Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:48 WIB

Official record

HighPublished 01 Oct 2026, 03:01 WIB

CVE-2026-102995

pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:01:43.354Z. Updated 2026-10-01T18:50:37.942Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 01:50 WIB

Official record

HighPublished 01 Oct 2026, 02:57 WIB

CVE-2026-102994

pypdf: Possible long runtimes/large memory usage when parsing indirect objects

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:57:37.810Z. Updated 2026-09-30T20:50:16.366Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:50 WIB

Official record

HighPublished 01 Oct 2026, 02:55 WIB

CVE-2026-102993

pypdf: Possible large memory usage when retrieving Roman page labels

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:55:52.294Z. Updated 2026-10-02T16:32:16.809Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 23:32 WIB

Official record

CritPublished 01 Oct 2026, 02:50 WIB

CVE-2026-102992

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:50:18.036Z. Updated 2026-09-30T20:47:49.562Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:47 WIB

Official record

MedPublished 01 Oct 2026, 02:47 WIB

CVE-2026-102991

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpath to absorb t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:47:07.128Z. Updated 2026-09-30T19:54:41.077Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:54 WIB

Official record

MedPublished 01 Oct 2026, 02:45 WIB

CVE-2026-103548

Improperly Stored Credentials

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:45:14.182Z. Updated 2026-09-30T19:56:27.037Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:56 WIB

Official record

MedPublished 01 Oct 2026, 02:45 WIB

CVE-2026-103387

garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been made available to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:45:07.542Z. Updated 2026-09-30T19:55:03.125Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:55 WIB

Official record

HighPublished 01 Oct 2026, 02:44 WIB

CVE-2026-102990

basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:44:47.303Z. Updated 2026-09-30T20:05:49.721Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:05 WIB

Official record

CritPublished 01 Oct 2026, 02:40 WIB

CVE-2026-103547

CVE-2026-103547

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier au…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:40:53.200Z. Updated 2026-09-30T19:55:54.044Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:55 WIB

Official record

HighPublished 01 Oct 2026, 02:16 WIB

CVE-2026-101885

ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell start…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:16:05.426Z. Updated 2026-09-30T19:55:05.567Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:55 WIB

Official record

HighPublished 01 Oct 2026, 02:16 WIB

CVE-2026-101884

OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or java to load atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:16:04.686Z. Updated 2026-09-30T19:33:24.196Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:33 WIB

Official record

MedPublished 01 Oct 2026, 02:16 WIB

CVE-2026-101883

OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to localhost, private netwo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:16:03.985Z. Updated 2026-10-02T16:30:11.622Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 23:30 WIB

Official record

HighPublished 01 Oct 2026, 02:16 WIB

CVE-2026-101882

OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through sys…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:16:03.309Z. Updated 2026-10-01T15:29:01.764Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:29 WIB

Official record

HighPublished 01 Oct 2026, 02:16 WIB

CVE-2026-101881

OpenClaw Windows Node before 2026.7.1 Denial of Service

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:16:02.477Z. Updated 2026-09-30T19:53:47.897Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:53 WIB

Official record

HighPublished 01 Oct 2026, 02:16 WIB

CVE-2026-101880

OpenClaw Windows Node before 2026.7.1 Authorization Bypass

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:16:01.717Z. Updated 2026-09-30T19:34:05.680Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:34 WIB

Official record

HighPublished 01 Oct 2026, 02:16 WIB

CVE-2026-101879

OpenClaw Windows Node before 2026.7.1-3 Missing Authorization

OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get ov…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T19:16:01.014Z. Updated 2026-10-02T16:29:19.954Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 23:29 WIB

Official record