Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 451 published records · 6 KEV · 451 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

451 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit451100%
High00.00%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Mar 26451

Signal coverage

KEV-listed: 6
With a forecast: 451
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 1.3% · forecast 100% · unscored 0.00%.

Showing 1–20 of 451By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

CritPublished 01 Apr 2026, 04:45 WIB

CVE-2026-34449

SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T21:45:17.081Z. Updated 2026-04-01T15:52:56.545Z.

CVSS9.7v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 22:52 WIB

Official record

CritPublished 01 Apr 2026, 04:44 WIB

CVE-2026-34448

SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -> Asset Field” enabled. The vulnerable code accepts arbitrary http(s) URLs without …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 451.Next page

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T21:44:36.504Z. Updated 2026-04-03T16:05:31.678Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated03 Apr 2026, 23:05 WIB

Official record

CritPublished 01 Apr 2026, 04:18 WIB

CVE-2026-34406

APTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpoint

APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. Prior to version 2.0.1, the edit_user endpoint (POST /api/auth/edituser/<pk>) allows Any user who can reach that endpoint and submit crafted permissio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T21:18:51.205Z. Updated 2026-04-03T16:38:03.750Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated03 Apr 2026, 23:38 WIB

Official record

CritPublished 01 Apr 2026, 03:20 WIB

CVE-2026-1579

PX4 Autopilot Missing authentication for critical function

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T20:20:06.506Z. Updated 2026-03-31T20:36:09.044Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 03:36 WIB

Official record

CritPublished 01 Apr 2026, 01:40 WIB

CVE-2026-3356

Missing Authentication for Critical Function vulnerability in Anritsu Remote Spectrum Monitor

The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface. Because the device provides no mechanism to enable or configure authentication, the issue is inherent to its design rather than a deployment error.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T18:40:17.359Z. Updated 2026-04-01T13:43:44.724Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 20:43 WIB

Official record

CritPublished 31 Mar 2026, 23:56 WIB

CVE-2026-34361

HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-controlled URLs. Combined with a startsWith() URL prefix matching f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T16:56:11.163Z. Updated 2026-03-31T17:24:58.558Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated01 Apr 2026, 00:24 WIB

Official record

CritPublished 31 Mar 2026, 22:49 WIB

CVE-2026-34243

wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`

wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runn…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T15:49:27.333Z. Updated 2026-04-02T15:21:36.168Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 22:21 WIB

Official record

CritPublished 31 Mar 2026, 22:19 WIB

CVE-2026-34220

MikroORM is vulnerable to SQL Injection via specially crafted object

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This issue has been patched in versions 6.6.10 and 7.0.6.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T15:19:08.520Z. Updated 2026-04-02T15:19:12.949Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Apr 2026, 22:19 WIB

Official record

CritPublished 31 Mar 2026, 21:42 WIB

CVE-2026-34532

Parse Server: Cloud function validator bypass via prototype chain traversal

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0-alpha.11, an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. When a Cloud Function handler is decl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:42:10.481Z. Updated 2026-03-31T17:21:09.681Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 00:21 WIB

Official record

CritPublished 31 Mar 2026, 21:25 WIB

CVE-2026-0596

Command Injection in mlflow/mlflow

A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacharacters, such as `$()` or backticks, it allows for command su…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:25:27.716Z. Updated 2026-04-01T03:55:35.518Z.

CVSS9.6v3.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 10:55 WIB

Official record

CritPublished 31 Mar 2026, 21:10 WIB

CVE-2026-33579

OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:10:32.407Z. Updated 2026-09-24T14:17:24.260Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:17 WIB

Official record

CritPublished 31 Mar 2026, 21:02 WIB

CVE-2026-34202

Zebra node crash — V5 transaction hash panic (P2P reachable)

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that pass…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T14:02:56.454Z. Updated 2026-03-31T17:17:30.860Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 00:17 WIB

Official record

CritPublished 31 Mar 2026, 20:43 WIB

CVE-2026-34162

FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T13:43:20.981Z. Updated 2026-03-31T14:33:31.305Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 21:33 WIB

Official record

CritPublished 31 Mar 2026, 20:33 WIB

CVE-2026-34156

NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T13:33:11.325Z. Updated 2026-04-02T15:08:38.165Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated02 Apr 2026, 22:08 WIB

Official record

CritPublished 31 Mar 2026, 18:17 WIB

CVE-2026-32917

OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters are passed directly to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T11:17:13.890Z. Updated 2026-06-23T16:15:17.869Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

CritPublished 31 Mar 2026, 18:17 WIB

CVE-2026-32916

OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent methods to perform privi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T11:17:13.127Z. Updated 2026-06-23T16:15:17.167Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated23 Jun 2026, 23:15 WIB

Official record

CritPublished 31 Mar 2026, 16:53 WIB

CVE-2026-4317

SQL inyection in Umami Software application

SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which could allow an authenticated attacker to execute arbitrary SQL commands in the database.Specifically, they could manipulate the value of the 'timezone' request parameter by including malicious character…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T09:53:26.180Z. Updated 2026-03-31T18:04:01.109Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:04 WIB

Official record

CritPublished 31 Mar 2026, 15:58 WIB

CVE-2026-3107

Multiple vulnerabilities in Teampass

Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/index.php?page=items'. The application fails to properly sanitize and encode user-input data during the import process, allowing malicious JavaScript payload…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T08:58:59.688Z. Updated 2026-03-31T18:04:08.704Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:04 WIB

Official record

CritPublished 31 Mar 2026, 15:51 WIB

CVE-2026-3106

Multiple vulnerabilities in Teampass

Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the login form 'redacted/index.php'. During failed authentication attempts, the application does not properly clean or encode the information entered by the user in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T08:51:35.333Z. Updated 2026-03-31T18:04:26.550Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Apr 2026, 01:04 WIB

Official record

CritPublished 31 Mar 2026, 08:31 WIB

CVE-2026-32714

SciTokens vulnerable to SQL Injection in KeyCache

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (such as issuer and key_id). This allowed an attacker to execute arbitrary S…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-31T01:31:31.708Z. Updated 2026-03-31T13:58:33.774Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Mar 2026, 20:58 WIB

Official record