Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 901–920 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

HighPublished 28 May 2026, 04:32 WIB

CVE-2026-45322

OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain an OS command injection vulnerability in the shell action replay path. In affected releases, ShellReceiver.run_shell() passes a command string from action paramet…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T21:32:50.171Z. Updated 2026-05-28T13:21:51.736Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:21 WIB

Official record

HighPublished 28 May 2026, 04:05 WIB

CVE-2026-45152

uniget: Command Injection in tool.Check Leading to Arbitrary Code Execution

uniget is a universal installer and updater for (container) tools. Prior to 0.27.1, a command injection vulnerability exists in uniget due to unsafe execution of the check field from metadata files using /bin/bash -c. Because the check field is loaded directly from untrusted JSON metadata without validation or sanitiza…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 901 to 920 of 6933.First page Next page

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T21:05:00.990Z. Updated 2026-05-28T12:40:02.534Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 19:40 WIB

Official record

MedPublished 28 May 2026, 04:02 WIB

CVE-2026-44720

OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. This vulnerability is fixed in 2.0.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T21:02:29.706Z. Updated 2026-06-02T18:09:07.056Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Jun 2026, 01:09 WIB

Official record

CritPublished 28 May 2026, 04:00 WIB

CVE-2026-45083

Goobi viewer: Unauthenticated Solr Streaming Expression Proxy

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi viewer REST endpoint POST /api/v1/index/stream accepted an arbitrary Solr streaming expression from unauthenticated network clients and forwarded it to the backend Solr server w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T21:00:52.103Z. Updated 2026-05-28T13:04:14.870Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:04 WIB

Official record

HighPublished 28 May 2026, 03:59 WIB

CVE-2026-9208

Tanium addressed an unauthorized code execution vulnerability in Connect.

Tanium addressed an unauthorized code execution vulnerability in Connect.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:59:43.199Z. Updated 2026-05-28T13:22:32.052Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:22 WIB

Official record

MedPublished 28 May 2026, 03:56 WIB

CVE-2026-44247

Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size

Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook ser…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:56:47.220Z. Updated 2026-05-30T01:50:43.437Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 08:50 WIB

Official record

HighPublished 28 May 2026, 03:52 WIB

CVE-2026-45137

Anchor: Program<'info, System> is not properly validated

Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in programs that invoke system p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:52:23.381Z. Updated 2026-05-28T13:05:18.637Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:05 WIB

Official record

HighPublished 28 May 2026, 03:48 WIB

CVE-2026-45136

claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:48:22.312Z. Updated 2026-06-02T16:07:20.540Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated02 Jun 2026, 23:07 WIB

Official record

HighPublished 28 May 2026, 03:42 WIB

CVE-2026-44660

UltraJSON: Memory Leak in ujson.dump() on Write Failure

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:42:59.830Z. Updated 2026-05-30T01:49:35.278Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 May 2026, 08:49 WIB

Official record

HighPublished 28 May 2026, 03:24 WIB

CVE-2026-44712

pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes root RCE when pamusb-conf --reset-pads is run. A USB device with a crafted filesystem UUID (some controllers allow this) can inject the payload at --add-device ti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:24:23.131Z. Updated 2026-05-28T13:17:14.622Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:17 WIB

Official record

HighPublished 28 May 2026, 03:20 WIB

CVE-2026-44709

pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, pamusb-pinentry reads the PINENTRY_FALLBACK_APP environment variable and executes it directly without any validation. Any process that can set environment variables before pamusb-pinentry is invoked can point PINENTRY_FAL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:20:52.529Z. Updated 2026-06-02T17:59:08.656Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated03 Jun 2026, 00:59 WIB

Official record

MedPublished 28 May 2026, 03:19 WIB

CVE-2026-44710

pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to strcmp() without NULL checks. The GIO/UDisks API documentation states these accessors…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:19:35.374Z. Updated 2026-05-28T13:05:48.884Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:05 WIB

Official record

HighPublished 28 May 2026, 03:18 WIB

CVE-2026-44711

pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.

Excerpt language: en.

Severity high: primary CNA CVSS 7.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:18:46.385Z. Updated 2026-05-28T12:47:16.174Z.

CVSS7.9v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 19:47 WIB

Official record

MedPublished 28 May 2026, 03:15 WIB

CVE-2026-21785

HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy

A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:15:56.441Z. Updated 2026-05-28T13:13:55.021Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:13 WIB

Official record

HighPublished 28 May 2026, 03:13 WIB

CVE-2026-44713

pam_usb: Command injection via $TMUX environment variable leads to RCE as root

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen(). Because the value is placed inside double-quotes wit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:13:13.193Z. Updated 2026-05-30T01:48:00.396Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 08:48 WIB

Official record

HighPublished 28 May 2026, 03:11 WIB

CVE-2026-47269

pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->ut_addr_v6[0] != 0), which only tests the first 32-bit wo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:11:44.975Z. Updated 2026-05-28T12:50:50.859Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 19:50 WIB

Official record

MedPublished 28 May 2026, 03:10 WIB

CVE-2026-47270

pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:10:37.108Z. Updated 2026-05-28T13:25:31.065Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:25 WIB

Official record

MedPublished 28 May 2026, 03:08 WIB

CVE-2026-47271

pam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crash

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xrealloc(), and xstrdup() using assert(data != NULL). The C standard specifies that all assert() expressions are compiled out when NDEBUG is defined at build time.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:08:02.552Z. Updated 2026-05-28T13:38:47.997Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:38 WIB

Official record

HighPublished 28 May 2026, 03:06 WIB

CVE-2026-47272

pam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified that the user-side pad (~/.pamusb/device.pad) could be read, but did not enforce that the system-side pad (the pad file on the USB device) was also present and re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:06:15.388Z. Updated 2026-05-28T12:53:00.432Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 19:53 WIB

Official record

MedPublished 28 May 2026, 03:03 WIB

CVE-2026-47273

pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB device serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T20:03:39.297Z. Updated 2026-05-28T13:26:13.079Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:26 WIB

Official record