Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 2,533 published records · 8 KEV · 2,533 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

2,533 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High2,533100%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Jun 262,533

Signal coverage

KEV-listed: 8
With a forecast: 2,533
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.32% · forecast 100% · unscored 0.00%.

Showing 1–20 of 2,533By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 2,533, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

HighPublished 01 Jul 2026, 06:16 WIB

CVE-2026-54592

Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process, leading to DoS. In a two-step chain in ext/oj/fast.c, doc_each_chi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T23:16:24.378Z. Updated 2026-07-01T12:35:39.923Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Jul 2026, 19:35 WIB

Official record

HighPublished 01 Jul 2026, 05:15 WIB

CVE-2026-54672

electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`

electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:15:03.264Z. Updated 2026-07-01T13:47:40.124Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:47 WIB

Official record

HighPublished 01 Jul 2026, 05:11 WIB

CVE-2026-54673

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:11:37.587Z. Updated 2026-07-01T13:26:49.397Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:26 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2026-57995

phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a gro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:42.294Z. Updated 2026-07-01T13:15:35.550Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:15 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56328

Capgo - Integrity Issue in Release Routing via Multiple Public Channels

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update state and silently influenc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:32.000Z. Updated 2026-07-01T14:28:26.968Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:28 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56320

Capgo - Org/App Scope Mismatch in Device Creation Endpoint

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it matches the target app's owner organization. Authenticated attackers can create device records for an application using a foreign organization identifier, bypassing t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:30.611Z. Updated 2026-07-01T15:02:29.500Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:02 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56300

Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, sig…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:29.294Z. Updated 2026-07-01T13:52:12.696Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:52 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56286

Capgo - Account Deletion Without Password Confirmation

Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication or secondary verification. Attackers can delete user accounts via session hijacking, CSRF attacks, or parameter tampering, resulting in unauthorized account dele…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:28.619Z. Updated 2026-07-01T14:35:11.611Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:35 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56249

Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations to rea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:25.919Z. Updated 2026-07-01T13:18:48.309Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:18 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56247

Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment

Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pre-seed malformed high-privilege bindings that survive invite acceptance, enabling accepted low-privilege users to perform unauthorized privileg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:24.865Z. Updated 2026-07-01T13:55:51.029Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:55 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56233

Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy

Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:24.213Z. Updated 2026-07-01T14:38:24.880Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:38 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56230

Capgo - Broken Object Level Authorization via x-limited-key-id Header

Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass aut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:23.538Z. Updated 2026-07-01T14:28:44.788Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:28 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56219

Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass

Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to retrieve RBAC role bindings and member email addresses. Attackers can exploit improper NULL comparison in the authorization gate to disclose organization membership, r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:22.177Z. Updated 2026-07-01T14:57:46.820Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:57 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2025-71374

picklescan - Arbitrary Code Execution via Undetected profile.Profile.run

picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:20.846Z. Updated 2026-07-01T13:56:27.888Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:56 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2025-71371

picklescan - Remote Code Execution via code.InteractiveInterpreter Detection Bypass

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:20.162Z. Updated 2026-07-01T14:07:18.792Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:07 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2025-71368

picklescan - Arbitrary Code Execution via Undetected doctest.debug_script

picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debug_script calls that bypass picklescan detection and execute arbitrary commands upon pickle.load in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:19.476Z. Updated 2026-07-01T14:28:54.566Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:28 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2025-71363

picklescan - Arbitrary Code Execution via Undetected cProfile.run in Pickle Deserialization

picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklescan detection and achieve code execution upon deserialization.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:18.794Z. Updated 2026-07-01T13:01:47.771Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:01 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2025-71355

Picklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection Bypass

Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization. Attackers can craft malicious pickle files using numpy.testing._private.utils.runstring within the reduce method to import dangerous libr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:18.129Z. Updated 2026-07-01T14:55:55.592Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:55 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2025-71352

picklescan - Remote Code Execution via Undetected trace.Trace.runctx in Pickle Files

picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with trace.Trace.runctx payloads that bypass picklescan detection and execute code upon pickle…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:17.415Z. Updated 2026-07-01T13:20:09.432Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:20 WIB

Official record

HighPublished 01 Jul 2026, 05:08 WIB

CVE-2025-71350

picklescan - Undetected Remote Code Execution via torch.utils.collect_env.run

picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:16.758Z. Updated 2026-07-01T13:57:37.901Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:57 WIB

Official record

Showing 1 to 20 of 2533.Next page