Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 36 published records · 0 KEV · 36 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

36 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med00.00%
Low00.00%
None36100%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Feb 2636

Signal coverage

KEV-listed: 0
With a forecast: 36
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.00% · forecast 100% · unscored 0.00%.

Showing 1–20 of 36By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 36, Legacy · v2 only 0, Unscored · no CNA metric 0

NonePublished 28 Feb 2026, 04:40 WIB

CVE-2026-27167

Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret

Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:40:57.917Z. Updated 2026-03-02T22:02:47.868Z.

CVSS0v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 05:02 WIB

Official record

NonePublished 27 Feb 2026, 02:25 WIB

CVE-2026-26979

Discourse: TL4 users are able to change status of restricted topics

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in private categories they don't have access to. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 36.Next page

Published 2026-02-26T19:25:15.812Z. Updated 2026-02-26T20:38:24.755Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:38 WIB

Official record

NonePublished 26 Feb 2026, 01:53 WIB

CVE-2026-24005

OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field

Kruise provides automated management of large-scale applications on Kubernetes. Prior to versions 1.8.3 and 1.7.5, PodProbeMarker allows defining custom probes with TCPSocket or HTTPGet handlers. The webhook validation does not restrict the Host field in these probe configurations. Since kruise-daemon runs with hostNet…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-25T18:53:30.170Z. Updated 2026-02-26T20:44:09.282Z.

CVSS0v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 03:44 WIB

Official record

NonePublished 07 Feb 2026, 02:11 WIB

CVE-2026-22254

Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the B…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-06T19:11:27.260Z. Updated 2026-02-09T15:28:17.194Z.

CVSS0v3.1KEVNot listedEPSSPresentUpdated09 Feb 2026, 22:28 WIB

Official record

NonePublished 06 Feb 2026, 23:47 WIB

CVE-2026-23741

ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper file. The script will source the contents of /etc/asterisk/a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-06T16:47:19.611Z. Updated 2026-02-06T17:26:22.216Z.

CVSS0v3.1KEVNot listedEPSSPresentUpdated07 Feb 2026, 00:26 WIB

Official record

NonePublished 06 Feb 2026, 23:43 WIB

CVE-2026-23740

Asterisk vulnerable to potential privilege escalation

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write permission(which is all users on a linux…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-06T16:43:41.330Z. Updated 2026-02-06T19:11:55.655Z.

CVSS0v3.1KEVNot listedEPSSPresentUpdated07 Feb 2026, 02:11 WIB

Official record

NonePublished 03 Feb 2026, 08:30 WIB

CVE-2025-67481

mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:30:39.642Z. Updated 2026-02-03T15:31:43.813Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated03 Feb 2026, 22:31 WIB

Official record

NonePublished 03 Feb 2026, 08:26 WIB

CVE-2025-67483

Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:26:27.931Z. Updated 2026-02-03T21:02:32.581Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated04 Feb 2026, 04:02 WIB

Official record

NonePublished 03 Feb 2026, 08:24 WIB

CVE-2025-67484

Action API xslt option allows JavaScript execution by administrators who are not interface administrators

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:24:56.405Z. Updated 2026-03-03T15:51:26.691Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated03 Mar 2026, 22:51 WIB

Official record

NonePublished 03 Feb 2026, 08:23 WIB

CVE-2025-67480

list=allrevisions can be used to bypass Extension:Lockdown

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:23:01.717Z. Updated 2026-03-03T15:50:19.557Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated03 Mar 2026, 22:50 WIB

Official record

NonePublished 03 Feb 2026, 08:21 WIB

CVE-2025-67475

Stored XSS through edit summaries in MW Core

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:21:09.480Z. Updated 2026-02-03T15:32:07.211Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated03 Feb 2026, 22:32 WIB

Official record

NonePublished 03 Feb 2026, 08:16 WIB

CVE-2025-67477

Stored XSS through a system message in Special:ApiSandbox

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:16:40.616Z. Updated 2026-02-03T15:32:21.011Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated03 Feb 2026, 22:32 WIB

Official record

NonePublished 03 Feb 2026, 08:14 WIB

CVE-2025-67478

Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"

Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:14:17.814Z. Updated 2026-03-02T17:43:34.432Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated03 Mar 2026, 00:43 WIB

Official record

NonePublished 03 Feb 2026, 08:12 WIB

CVE-2025-67479

Magic word replacement in legacy parser allows using reserved data attributes through wikitext

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Cite: from * before 1.39.14, 1.43.4, 1.44.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:12:21.567Z. Updated 2026-03-02T17:42:31.216Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated03 Mar 2026, 00:42 WIB

Official record

NonePublished 03 Feb 2026, 08:08 WIB

CVE-2025-61654

UserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanks

Vulnerability in Wikimedia Foundation Thanks. This vulnerability is associated with program files includes/ThanksQueryHelper.Php. This issue affects Thanks: from * before 1.43.4, 1.44.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:08:57.273Z. Updated 2026-03-03T15:44:29.769Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated03 Mar 2026, 22:44 WIB

Official record

NonePublished 03 Feb 2026, 08:04 WIB

CVE-2025-61655

Stored XSS through system messages in VisualEditor

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js, modules/ve-mw/ui/dialogs/ve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:04:35.944Z. Updated 2026-02-03T21:00:52.979Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated04 Feb 2026, 04:00 WIB

Official record

NonePublished 03 Feb 2026, 08:02 WIB

CVE-2025-61656

XSS when pasting into VE

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:02:48.955Z. Updated 2026-02-03T21:00:33.782Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated04 Feb 2026, 04:00 WIB

Official record

NonePublished 03 Feb 2026, 08:00 WIB

CVE-2025-61657

CVE-2025-61657

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T01:00:59.692Z. Updated 2026-02-03T21:00:15.785Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated04 Feb 2026, 04:00 WIB

Official record

NonePublished 03 Feb 2026, 07:53 WIB

CVE-2025-61651

i18n XSS through Special:CheckUser CheckUser helper

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.Js. This issue affects CheckUser: from * before 1.44.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T00:53:14.630Z. Updated 2026-02-03T21:08:33.097Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated04 Feb 2026, 04:08 WIB

Official record

NonePublished 03 Feb 2026, 07:27 WIB

CVE-2025-11173

Reauth for enabling 2FA can be bypassed by submitting a form

Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php. This issue affects OATHAuth: from * before 1.39.14, 1.43.4, 1.44.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-03T00:27:45.487Z. Updated 2026-02-03T21:08:02.478Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated04 Feb 2026, 04:08 WIB

Official record