Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 926 published records · 12 KEV · 926 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

926 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit926100%
High00.00%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Jul 26926

Signal coverage

KEV-listed: 12
With a forecast: 926
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 1.3% · forecast 100% · unscored 0.00%.

Showing 1–20 of 926By severity band: Critical · 9.0–10.0 926, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

CritPublished 01 Aug 2026, 04:16 WIB

CVE-2026-68771

ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T21:16:09.970Z. Updated 2026-09-24T14:18:29.656Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:18 WIB

Official record

CritPublished 01 Aug 2026, 03:56 WIB

CVE-2026-68770

sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 926.Next page

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T20:56:06.867Z. Updated 2026-10-08T15:24:17.537Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

CritPublished 01 Aug 2026, 00:45 WIB

CVE-2026-54725

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:45:09.548Z. Updated 2026-07-31T18:58:46.332Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:58 WIB

Official record

CritPublished 31 Jul 2026, 23:35 WIB

CVE-2026-58048

CVE-2026-58048

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:35:56.665Z. Updated 2026-08-07T18:00:28.533Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated08 Aug 2026, 01:00 WIB

Official record

CritPublished 31 Jul 2026, 23:16 WIB

CVE-2026-52855

Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuratio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:16:42.470Z. Updated 2026-07-31T19:55:37.770Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:55 WIB

Official record

CritPublished 31 Jul 2026, 23:00 WIB

CVE-2026-17566

pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, ga…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:00:22.738Z. Updated 2026-08-01T03:56:13.838Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 10:56 WIB

Official record

CritPublished 31 Jul 2026, 23:00 WIB

CVE-2026-17351

pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing can disagree with Pos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:00:19.103Z. Updated 2026-08-01T03:56:14.973Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 10:56 WIB

Official record

CritPublished 31 Jul 2026, 22:59 WIB

CVE-2026-17349

pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T15:59:47.841Z. Updated 2026-08-01T03:56:26.176Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 10:56 WIB

Official record

CritPublished 31 Jul 2026, 19:49 WIB

CVE-2026-17561

Unauthenticated RCE in Innotim Software's Logsign SIEM

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: before 6.4.115.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T12:49:56.946Z. Updated 2026-08-20T15:22:01.873Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:22 WIB

Official record

CritPublished 31 Jul 2026, 18:40 WIB

CVE-2025-67649

Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T11:40:25.708Z. Updated 2026-07-31T19:49:42.174Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:49 WIB

Official record

CritPublished 31 Jul 2026, 12:54 WIB

CVE-2026-18452

Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials

DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T05:54:55.052Z. Updated 2026-07-31T19:25:00.663Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:25 WIB

Official record

CritPublished 31 Jul 2026, 12:35 WIB

CVE-2026-14483

Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T05:35:22.781Z. Updated 2026-07-31T19:26:05.373Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:26 WIB

Official record

CritPublished 31 Jul 2026, 11:10 WIB

CVE-2026-63223

CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T04:10:28.179Z. Updated 2026-07-31T23:16:24.574Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 06:16 WIB

Official record

CritPublished 31 Jul 2026, 11:03 WIB

CVE-2026-63221

CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. R…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T04:03:34.352Z. Updated 2026-07-31T13:52:40.376Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated31 Jul 2026, 20:52 WIB

Official record

CritPublished 31 Jul 2026, 10:00 WIB

CVE-2026-43832

CVE-2026-43832

A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T03:00:49.264Z. Updated 2026-10-20T07:43:28.280Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated20 Oct 2026, 14:43 WIB

Official record

CritPublished 31 Jul 2026, 09:57 WIB

CVE-2026-43831

CVE-2026-43831

A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T02:57:11.653Z. Updated 2026-10-20T07:50:04.010Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated20 Oct 2026, 14:50 WIB

Official record

CritPublished 31 Jul 2026, 09:48 WIB

CVE-2026-43829

CVE-2026-43829

A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T02:48:23.886Z. Updated 2026-10-20T07:50:52.398Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated20 Oct 2026, 14:50 WIB

Official record

CritPublished 31 Jul 2026, 03:55 WIB

CVE-2026-66418

OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notificat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-30T20:55:24.766Z. Updated 2026-09-24T14:18:24.705Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:18 WIB

Official record

CritPublished 31 Jul 2026, 03:39 WIB

CVE-2026-68503

LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-30T20:39:34.763Z. Updated 2026-07-31T15:59:00.803Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Jul 2026, 22:59 WIB

Official record

CritPublished 31 Jul 2026, 03:38 WIB

CVE-2026-68502

LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-30T20:38:05.485Z. Updated 2026-07-31T14:07:30.409Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Jul 2026, 21:07 WIB

Official record