Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 961–980 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25209

OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter

OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database info…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:55.703Z. Updated 2026-03-26T18:25:23.772Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:25 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25208

qdPM 9.1 SQL Injection via filter_by Parameters

qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 961 to 980 of 6236.First page Next page

Published 2026-03-26T11:39:54.728Z. Updated 2026-03-26T18:35:47.179Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:35 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25207

Online Quiz Maker 1.0 SQL Injection via catid Parameter

Online Quiz Maker 1.0 contains SQL injection vulnerabilities in the catid and usern parameters that allow authenticated attackers to execute arbitrary SQL commands. Attackers can submit malicious POST requests to quiz-system.php or add-category.php with crafted SQL payloads in POST parameters to extract sensitive datab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:53.997Z. Updated 2026-07-15T01:23:28.972Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25206

KomSeo Cart 1.3 SQL Injection via edit.php

KomSeo Cart 1.3 contains an SQL injection vulnerability that allows attackers to inject SQL commands through the 'my_item_search' parameter in edit.php. Attackers can submit POST requests with malicious SQL payloads to extract sensitive database information using boolean-based blind or error-based injection techniques.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:53.286Z. Updated 2026-03-28T02:15:20.514Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 09:15 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25205

ASP.NET jVideo Kit 1.0 SQL Injection via query Parameter

ASP.NET jVideo Kit 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the 'query' parameter in the search functionality. Attackers can submit malicious SQL payloads via GET or POST requests to the /search endpoint to extract sensitive database information us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:52.323Z. Updated 2026-03-26T13:37:09.410Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:37 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25204

Library CMS 1.0 SQL Injection via admin login

Library CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can send POST requests to the admin login endpoint with boolean-based blind SQL injection payloads in the username field to manipulate da…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:51.681Z. Updated 2026-03-26T18:36:14.410Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:36 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25203

Online Store System CMS 1.0 SQL Injection via clientaccess

Online Store System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter. Attackers can send POST requests to index.php with the action=clientaccess parameter using boolean-based blind or time-based blind S…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:51.055Z. Updated 2026-07-15T01:23:28.289Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25202

SAT CFDI 3.3 SQL Injection via signIn endpoint

SAT CFDI 3.3 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id' parameter in the signIn endpoint. Attackers can submit POST requests with boolean-based blind, stacked queries, or time-based blind SQL injection payloads to extract sensitive…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:50.398Z. Updated 2026-03-26T18:44:03.302Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:44 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25201

School Management System CMS 1.0 Admin Login SQL Injection

School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious payloads using boolean-based blind SQL injection techniques to the processlogin en…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:49.622Z. Updated 2026-03-26T13:02:45.335Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:02 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25195

Wecodex Hotel CMS 1.0 SQL Injection via Admin Login

Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication by injecting SQL code. Attackers can submit malicious SQL payloads through the username parameter in POST requests to index.php with action=processlogin to extrac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:48.998Z. Updated 2026-03-28T02:14:12.286Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 09:14 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25185

Wecodex Restaurant CMS 1.0 SQL Injection via Login

Wecodex Restaurant CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the username parameter. Attackers can send POST requests to the login endpoint with malicious SQL payloads using boolean-based blind or time-based blind t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:48.380Z. Updated 2026-03-26T13:38:07.688Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:38 WIB

Official record

HighPublished 26 Mar 2026, 18:39 WIB

CVE-2018-25183

Shipping System CMS 1.0 SQL Injection via admin login

Shipping System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious SQL payloads using boolean-based blind techniques in POST requests to the admin login endpoint to authentica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:39:47.622Z. Updated 2026-03-26T18:44:34.674Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:44 WIB

Official record

HighPublished 26 Mar 2026, 18:37 WIB

CVE-2025-41368

Multiple vulnerabilities in Small HTTP server by Smallsrv

Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outside the document root configured on the server.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:37:52.747Z. Updated 2026-03-26T13:40:20.561Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:40 WIB

Official record

CritPublished 26 Mar 2026, 18:03 WIB

CVE-2026-4809

Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable

plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign imag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T11:03:27.086Z. Updated 2026-08-10T11:43:52.211Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated10 Aug 2026, 18:43 WIB

Official record

UnscoredPublished 26 Mar 2026, 17:55 WIB

CVE-2026-24068

Missing XPC Client & NSXPC endpoint validation leads to privilege escalation in Vienna Assistant (MacOS) - Vienna Symphonic Library

The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all. This means that any process can connect to this service u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T10:55:54.603Z. Updated 2026-04-03T05:33:07.150Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 12:33 WIB

Official record

MedPublished 26 Mar 2026, 17:43 WIB

CVE-2026-4274

Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T10:43:24.611Z. Updated 2026-03-26T13:58:41.567Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:58 WIB

Official record

UnscoredPublished 26 Mar 2026, 17:22 WIB

CVE-2026-23398

icmp: fix NULL pointer dereference in icmp_tag_validation()

In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 prot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T10:22:50.606Z. Updated 2026-10-15T01:14:50.052Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 26 Mar 2026, 17:22 WIB

CVE-2026-23397

nfnetlink_osf: validate individual option lengths in fingerprints

In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback() validates opt_num bounds and string NUL-termination but does not check individual option length fields. A zero-length option causes nf_osf_match_one() to enter …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T10:22:49.954Z. Updated 2026-10-15T01:14:48.282Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 26 Mar 2026, 17:22 WIB

CVE-2026-23396

wifi: mac80211: fix NULL deref in mesh_matches_local()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in mesh_matches_local() mesh_matches_local() unconditionally dereferences ie->mesh_config to compare mesh configuration parameters. When called from mesh_rx_csa_frame(), the parsed action-frame elements may not contain …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T10:22:49.287Z. Updated 2026-10-15T01:14:46.530Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

MedPublished 26 Mar 2026, 16:12 WIB

CVE-2026-4263

Incorrect authorization in HiJiffy Chatbot

Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the parameter 'visitor' in '/api/v1/webchat/message'.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T09:12:45.571Z. Updated 2026-06-09T08:58:49.098Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Jun 2026, 15:58 WIB

Official record