Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 558 published records · 13 KEV · 558 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

558 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit558100%
High00.00%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

May 26558

Signal coverage

KEV-listed: 13
With a forecast: 558
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 2.3% · forecast 100% · unscored 0.00%.

Showing 1–20 of 558By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

CritPublished 31 May 2026, 21:15 WIB

CVE-2026-10187

Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow

A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305. Affected by this issue is the function setWiFiBasicConfig of the file wireless.so of the component Web Management Interface. Performing a manipulation of the argument KeyStr results in stack-based buffer overflow. The attack is possible to be carried …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-31T14:15:14.047Z. Updated 2026-06-02T14:51:15.521Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2026, 21:51 WIB

Official record

CritPublished 30 May 2026, 21:55 WIB

CVE-2018-25412

Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php

Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to docs_upload.php with crafted multipart form data. Attackers can upload PHP files with arbitrary content to the upload directory and execute them on the server for r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 558.Next page

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-30T14:55:18.571Z. Updated 2026-10-01T15:19:15.802Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

CritPublished 30 May 2026, 02:21 WIB

CVE-2026-45372

cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T19:21:12.313Z. Updated 2026-06-01T17:57:44.116Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 00:57 WIB

Official record

CritPublished 30 May 2026, 02:01 WIB

CVE-2026-45697

Formie: Pre-authenticated server-side template injection in Hidden fields

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T19:01:49.220Z. Updated 2026-06-01T15:18:51.317Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:18 WIB

Official record

CritPublished 30 May 2026, 01:04 WIB

CVE-2026-9051

Authentication Bypass Vulnerability in NI SystemLink Enterprise

There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclosure. Successful exploitation requires an attacker to send a specially crafted H…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T18:04:48.703Z. Updated 2026-05-29T18:45:55.475Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated30 May 2026, 01:45 WIB

Official record

CritPublished 30 May 2026, 00:58 WIB

CVE-2026-47744

Shopper: Authorization bypass and RBAC privilege escalation in team settings

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:58:21.342Z. Updated 2026-05-29T21:38:15.231Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 04:38 WIB

Official record

CritPublished 30 May 2026, 00:48 WIB

CVE-2026-44650

SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, POST /api/extensions/delete endpoint accepts extensionName: "." which bypasses sanitize-filename validation, causing the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:48:03.396Z. Updated 2026-05-29T19:13:57.913Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 02:13 WIB

Official record

CritPublished 30 May 2026, 00:45 WIB

CVE-2026-44649

SillyTavern: Authentication Bypass via SSO Header Injection

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern accepts Remote-User (Authelia) and X-Authentik-Username (Authentik) HTTP headers to automatically log in use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:45:26.073Z. Updated 2026-06-02T01:48:37.402Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 08:48 WIB

Official record

CritPublished 30 May 2026, 00:18 WIB

CVE-2026-45668

Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:18:28.997Z. Updated 2026-05-29T19:23:26.469Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated30 May 2026, 02:23 WIB

Official record

CritPublished 30 May 2026, 00:11 WIB

CVE-2026-7786

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and used to authenticate to device services.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:11:33.184Z. Updated 2026-05-29T19:31:38.170Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 02:31 WIB

Official record

CritPublished 30 May 2026, 00:10 WIB

CVE-2026-45625

Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps source repositories and their stored credentials. Eight of those endpoints (…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T17:10:57.210Z. Updated 2026-06-01T15:21:59.466Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:21 WIB

Official record

CritPublished 29 May 2026, 23:40 WIB

CVE-2026-45629

Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the /listen-deployment WebSocket endpoint allows any organization member to execute arbitrary system commands on remote servers managed by Dokploy, leading to full server compromise.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T16:40:59.537Z. Updated 2026-06-02T01:46:14.481Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 08:46 WIB

Official record

CritPublished 29 May 2026, 23:33 WIB

CVE-2026-45628

Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated dire…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T16:33:23.681Z. Updated 2026-05-29T19:29:45.302Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 02:29 WIB

Official record

CritPublished 29 May 2026, 23:25 WIB

CVE-2026-5386

KMW CCTV Security Cameras Unverified Password Change

The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated password reset. This flaw allows an attacker to remotely reset the administrator password to a known value without authentication, granting full access to the camera feeds and settings.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T16:25:17.079Z. Updated 2026-05-29T19:30:48.817Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 02:30 WIB

Official record

CritPublished 29 May 2026, 23:15 WIB

CVE-2026-45630

Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via unsanitized echo shell interpolation.

Excerpt language: en.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T16:15:36.086Z. Updated 2026-06-01T18:45:18.218Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 01:45 WIB

Official record

CritPublished 29 May 2026, 23:13 WIB

CVE-2026-45631

Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the built-in SSH termi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T16:13:59.525Z. Updated 2026-06-01T15:23:23.234Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 22:23 WIB

Official record

CritPublished 29 May 2026, 23:11 WIB

CVE-2026-45632

Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId. Schedule types serv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T16:11:19.414Z. Updated 2026-06-02T15:46:32.430Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 22:46 WIB

Official record

CritPublished 29 May 2026, 23:10 WIB

CVE-2026-45633

Dokploy: Command Injection in /docker-container-logs Endpoint

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T16:10:20.278Z. Updated 2026-05-29T18:25:04.705Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 01:25 WIB

Official record

CritPublished 29 May 2026, 23:07 WIB

CVE-2026-45661

Dokploy: Remote Code Execution through Path Traversal

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T16:07:54.491Z. Updated 2026-06-02T01:41:47.863Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 08:41 WIB

Official record

CritPublished 29 May 2026, 23:03 WIB

CVE-2026-45663

Dokploy: Remote Code Execution via destinationPath in Container File Upload

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. When an authenticated user uploads a file to a container, the destinationPath parameter is not properly sanitized and is directly interpolated into a sh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-29T16:03:22.999Z. Updated 2026-05-29T20:40:48.564Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated30 May 2026, 03:40 WIB

Official record