Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 981–1000 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 29 Sep 2026, 22:42 WIB

CVE-2026-92370

Remote Session Access Control Bypass Leading to Remote Code Execution

An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:42:27.283Z. Updated 2026-09-30T15:28:18.681Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

LowPublished 29 Sep 2026, 22:42 WIB

CVE-2026-102630

UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and wh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 981 to 1000 of 14934.First page Next page

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:42:20.741Z. Updated 2026-10-02T12:10:19.101Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:10 WIB

Official record

HighPublished 29 Sep 2026, 22:41 WIB

CVE-2026-92371

Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in un…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:41:12.493Z. Updated 2026-09-30T15:28:18.820Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

HighPublished 29 Sep 2026, 22:40 WIB

CVE-2026-92368

Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially cr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:40:30.767Z. Updated 2026-09-30T15:28:18.950Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

HighPublished 29 Sep 2026, 22:39 WIB

CVE-2026-92369

Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:39:53.082Z. Updated 2026-09-30T15:28:19.100Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

HighPublished 29 Sep 2026, 22:39 WIB

CVE-2026-19743

Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the lo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:39:11.503Z. Updated 2026-09-30T15:28:19.226Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:28 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:38 WIB

CVE-2026-100287

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:38:53.604Z. Updated 2026-09-29T16:40:39.457Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:40 WIB

Official record

HighPublished 29 Sep 2026, 22:36 WIB

CVE-2026-97689

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:36:05.963Z. Updated 2026-09-29T16:23:23.167Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:23 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:33 WIB

CVE-2026-100286

CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:33:56.325Z. Updated 2026-09-29T16:41:18.693Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:41 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-84784

QUIC: Unbounded RETIRE_CONNECTION_ID Backlog

Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID fra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:25.758Z. Updated 2026-09-29T16:44:09.766Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:44 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-84783

Use-After-Free in X.509 Extension Cache Under Concurrent Use

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client ce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:24.699Z. Updated 2026-09-29T16:42:41.306Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:42 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-84782

DTLS Retransmits Handshake Messages From a Stale Buffer Offset

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:23.605Z. Updated 2026-09-29T16:45:40.378Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:45 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-77696

Timing Side-Channel in SM2 Signature Generation

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:22.520Z. Updated 2026-09-29T16:51:33.618Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:51 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-75806

Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:21.457Z. Updated 2026-09-29T16:53:23.785Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:53 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-75805

NULL Pointer Dereference in CMP Client Revocation Response Handling

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:20.408Z. Updated 2026-09-29T16:54:39.263Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:54 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-75804

QUIC Connection-Level Flow Control is Not Enforced for Streams

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:19.335Z. Updated 2026-09-29T17:15:40.043Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 00:15 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-72897

Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake

Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applicatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:18.277Z. Updated 2026-09-29T17:16:38.842Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 00:16 WIB

Official record

MedPublished 29 Sep 2026, 22:32 WIB

CVE-2026-97688

urllib3: Chunked Deflate streaming can enter an infinite loop

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an un…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:17.622Z. Updated 2026-09-29T15:42:34.502Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 22:42 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-54875

Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platfor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:17.206Z. Updated 2026-09-29T17:17:20.483Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 00:17 WIB

Official record

UnscoredPublished 29 Sep 2026, 22:32 WIB

CVE-2026-54873

QUIC STREAM Fragment Metadata DoS

Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-29T15:32:16.134Z. Updated 2026-09-30T20:11:09.162Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record