Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 2,337 published records · 2 KEV · 2,337 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

2,337 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med2,337100%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Jun 262,337

Signal coverage

KEV-listed: 2
With a forecast: 2,337
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.09% · forecast 100% · unscored 0.00%.

Showing 1–20 of 2,337By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 2,337, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

MedPublished 01 Jul 2026, 06:42 WIB

CVE-2026-54903

Oj: Integer Overflow in Oj.load 2GB String Handling

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in buf_append_string (buf.h:61) converts the string length to a large negative size_t, causing memcpy …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T23:42:06.777Z. Updated 2026-07-01T12:43:48.523Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 19:43 WIB

Official record

MedPublished 01 Jul 2026, 06:40 WIB

CVE-2026-54902

Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key st…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 2337.Next page

Published 2026-06-30T23:40:32.627Z. Updated 2026-07-01T12:37:40.878Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 19:37 WIB

Official record

MedPublished 01 Jul 2026, 06:36 WIB

CVE-2026-54901

Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T23:36:38.526Z. Updated 2026-07-01T12:34:23.576Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 19:34 WIB

Official record

MedPublished 01 Jul 2026, 06:34 WIB

CVE-2026-54900

Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in form_attr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T23:34:05.904Z. Updated 2026-07-01T15:48:35.112Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:48 WIB

Official record

MedPublished 01 Jul 2026, 06:10 WIB

CVE-2026-54502

Oj: Stack Buffer Overflow in Oj.dump via Large Indent

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by the developer. fill_indent in dump.h calls memset(indent_str, ' ', (size_t)opts->indent) without validating the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T23:10:27.623Z. Updated 2026-07-01T15:50:28.392Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:50 WIB

Official record

MedPublished 01 Jul 2026, 06:08 WIB

CVE-2026-54500

Oj: intern.c form_attr has an uninitialized stack read

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T23:08:28.789Z. Updated 2026-07-01T14:26:18.970Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:26 WIB

Official record

MedPublished 01 Jul 2026, 06:03 WIB

CVE-2026-54899

Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not cle…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T23:03:15.696Z. Updated 2026-07-01T14:26:28.538Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:26 WIB

Official record

MedPublished 01 Jul 2026, 05:56 WIB

CVE-2026-55223

c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:56:55.895Z. Updated 2026-07-01T13:38:12.928Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:38 WIB

Official record

MedPublished 01 Jul 2026, 05:27 WIB

CVE-2026-50040

Cross-site Scripting in StoneFly Storage Concentrator

Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser session in the conte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:27:37.001Z. Updated 2026-07-01T15:35:58.586Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:35 WIB

Official record

MedPublished 01 Jul 2026, 05:15 WIB

CVE-2026-28322

SolarWinds Database Performance Analyzer Stored Cross-Site Scripting Vulnerability

SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:15:40.728Z. Updated 2026-07-02T03:57:26.377Z.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated02 Jul 2026, 10:57 WIB

Official record

MedPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56777

n8n - AST Validator Bypass in Python Code Node

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module namespace. The issue only af…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:41.624Z. Updated 2026-07-01T13:49:32.546Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:49 WIB

Official record

MedPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56399

Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:40.248Z. Updated 2026-07-01T14:28:07.871Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:28 WIB

Official record

MedPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56377

ImageMagick - Policy Bypass via Incorrect Path Validation

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:39.614Z. Updated 2026-07-01T14:55:29.511Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:55 WIB

Official record

MedPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56369

ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:38.920Z. Updated 2026-07-01T15:07:57.635Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:07 WIB

Official record

MedPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56365

ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing

ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:38.238Z. Updated 2026-07-01T13:16:12.822Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:16 WIB

Official record

MedPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56363

ImageMagick - Division by Zero in Binomial Kernel Processing

ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:36.839Z. Updated 2026-07-01T14:46:38.751Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:46 WIB

Official record

MedPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56361

ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing

ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:36.159Z. Updated 2026-07-01T14:28:19.148Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:28 WIB

Official record

MedPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56356

n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field

n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenticated user with permissi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:35.484Z. Updated 2026-07-01T13:24:34.456Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:24 WIB

Official record

MedPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56350

n8n - SSO Enforcement Bypass via API

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:34.810Z. Updated 2026-07-01T15:04:03.216Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:04 WIB

Official record

MedPublished 01 Jul 2026, 05:08 WIB

CVE-2026-56334

Capgo - Missing UPDATE RLS Policy for Build Status Persistence

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving build_requests rows stuck in pend…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-06-30T22:08:34.059Z. Updated 2026-07-01T13:16:59.633Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 20:16 WIB

Official record