Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 2,953 published records · 3 KEV · 2,953 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

2,953 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med2,953100%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Jul 262,953

Signal coverage

KEV-listed: 3
With a forecast: 2,953
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.10% · forecast 100% · unscored 0.00%.

Showing 1–20 of 2,953By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 2,953, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

MedPublished 01 Aug 2026, 05:58 WIB

CVE-2026-45377

Decidim: Private exports can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by any…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T22:58:22.730Z. Updated 2026-07-31T23:37:39.654Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 06:37 WIB

Official record

MedPublished 01 Aug 2026, 05:34 WIB

CVE-2026-45376

Decidim: Admin user search allows SQL injection through similarity-based sorting

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 2953.Next page

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T22:34:27.181Z. Updated 2026-08-03T17:13:15.144Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated04 Aug 2026, 00:13 WIB

Official record

MedPublished 01 Aug 2026, 05:31 WIB

CVE-2026-54785

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Becaus…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T22:31:04.190Z. Updated 2026-08-03T16:26:53.194Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated03 Aug 2026, 23:26 WIB

Official record

MedPublished 01 Aug 2026, 05:24 WIB

CVE-2026-54768

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T22:24:40.639Z. Updated 2026-08-03T20:36:22.466Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Aug 2026, 03:36 WIB

Official record

MedPublished 01 Aug 2026, 05:16 WIB

CVE-2026-53573

core-geonetwork has an Open Redirect Bypass

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T22:16:25.110Z. Updated 2026-08-03T16:26:56.688Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated03 Aug 2026, 23:26 WIB

Official record

MedPublished 01 Aug 2026, 05:05 WIB

CVE-2026-45330

Decidim: Veriﬁcation admins can access supplied IDs from other organisations

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T22:05:21.773Z. Updated 2026-08-03T20:35:20.109Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated04 Aug 2026, 03:35 WIB

Official record

MedPublished 01 Aug 2026, 05:03 WIB

CVE-2026-54909

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T22:03:53.514Z. Updated 2026-08-03T17:30:22.558Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated04 Aug 2026, 00:30 WIB

Official record

MedPublished 01 Aug 2026, 04:44 WIB

CVE-2026-45086

Decidim: Forms admin question editor lacks authorization

Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire edi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T21:44:11.803Z. Updated 2026-08-03T17:16:23.640Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated04 Aug 2026, 00:16 WIB

Official record

MedPublished 01 Aug 2026, 03:12 WIB

CVE-2026-53551

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T20:12:57.932Z. Updated 2026-08-03T16:26:59.863Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Aug 2026, 23:26 WIB

Official record

MedPublished 01 Aug 2026, 02:34 WIB

CVE-2026-18394

Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users should upgrade to ve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T19:34:15.007Z. Updated 2026-07-31T20:01:07.095Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 03:01 WIB

Official record

MedPublished 01 Aug 2026, 02:16 WIB

CVE-2026-65841

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when content is loaded. This issu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T19:16:05.952Z. Updated 2026-07-31T20:05:10.590Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 03:05 WIB

Official record

MedPublished 01 Aug 2026, 02:08 WIB

CVE-2026-62324

Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T19:08:03.043Z. Updated 2026-08-03T17:26:47.204Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated04 Aug 2026, 00:26 WIB

Official record

MedPublished 01 Aug 2026, 01:12 WIB

CVE-2026-25552

Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain using the $proxy_add_x_f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:12:40.072Z. Updated 2026-08-14T16:49:40.070Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record

MedPublished 01 Aug 2026, 01:12 WIB

CVE-2026-18481

Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:12:23.067Z. Updated 2026-07-31T19:52:59.881Z.

CVSS6.2v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:52 WIB

Official record

MedPublished 01 Aug 2026, 01:04 WIB

CVE-2026-18321

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec

Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T18:04:06.697Z. Updated 2026-07-31T18:54:10.546Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:54 WIB

Official record

MedPublished 01 Aug 2026, 00:31 WIB

CVE-2026-34497

FMS Employee Vulnerable to HTML Injection

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:31:05.487Z. Updated 2026-07-31T18:10:50.071Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:10 WIB

Official record

MedPublished 01 Aug 2026, 00:30 WIB

CVE-2026-34495

FMS Employee vulnerable to XSS

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:30:52.669Z. Updated 2026-07-31T18:11:09.338Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:11 WIB

Official record

MedPublished 01 Aug 2026, 00:30 WIB

CVE-2026-21662

FMS Employee Allows Upload of Unrestricted Files

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:30:41.561Z. Updated 2026-07-31T18:24:41.723Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 01:24 WIB

Official record

MedPublished 01 Aug 2026, 00:17 WIB

CVE-2026-34490

XAAP Android Data Stored in Unencrypted Database

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T17:17:33.651Z. Updated 2026-07-31T17:38:49.752Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Aug 2026, 00:38 WIB

Official record

MedPublished 31 Jul 2026, 23:35 WIB

CVE-2026-58047

CVE-2026-58047

HTTP Smuggling in cPanel allows potential leak of credentials.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T16:35:56.600Z. Updated 2026-08-07T18:00:48.776Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated08 Aug 2026, 01:00 WIB

Official record