Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,597 published records · 8 KEV · 4,597 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,597 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High4,597100%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Aug 264,597

Signal coverage

KEV-listed: 8
With a forecast: 4,597
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.17% · forecast 100% · unscored 0.00%.

Showing 1–20 of 4,597By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 4,597, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

HighPublished 01 Sep 2026, 04:28 WIB

CVE-2026-82397

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T21:28:13.958Z. Updated 2026-09-02T17:39:41.238Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated03 Sep 2026, 00:39 WIB

Official record

HighPublished 01 Sep 2026, 04:15 WIB

CVE-2026-77348

Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 4597.Next page

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T21:15:45.388Z. Updated 2026-09-03T17:43:56.625Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated04 Sep 2026, 00:43 WIB

Official record

HighPublished 01 Sep 2026, 04:12 WIB

CVE-2026-82393

pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T21:12:09.196Z. Updated 2026-09-02T03:55:39.345Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 10:55 WIB

Official record

HighPublished 01 Sep 2026, 04:11 WIB

CVE-2026-82882

Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T21:11:01.297Z. Updated 2026-09-24T14:20:36.690Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:20 WIB

Official record

HighPublished 01 Sep 2026, 04:03 WIB

CVE-2026-82392

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T21:03:25.652Z. Updated 2026-09-01T14:57:53.435Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:57 WIB

Official record

HighPublished 01 Sep 2026, 03:53 WIB

CVE-2026-75594

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSla…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:53:00.338Z. Updated 2026-09-01T14:31:42.348Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:31 WIB

Official record

HighPublished 01 Sep 2026, 03:49 WIB

CVE-2026-61641

Wallos: OIDC account takeover via email-based account linking without `email_verified` check

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:49:46.759Z. Updated 2026-09-01T14:58:03.788Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:58 WIB

Official record

HighPublished 01 Sep 2026, 03:47 WIB

CVE-2026-61640

Wallos: SSRF via OIDC Token/UserInfo URL Configuration

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(),…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:47:39.969Z. Updated 2026-09-02T17:34:28.745Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Sep 2026, 00:34 WIB

Official record

HighPublished 01 Sep 2026, 03:46 WIB

CVE-2026-83596

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:46:24.116Z. Updated 2026-10-28T21:14:39.982Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:14 WIB

Official record

HighPublished 01 Sep 2026, 03:46 WIB

CVE-2026-71415

Kirby: File upload permissions are not checked during processing of chunk data

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the acces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:46:02.280Z. Updated 2026-09-03T18:02:09.849Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated04 Sep 2026, 01:02 WIB

Official record

HighPublished 01 Sep 2026, 03:44 WIB

CVE-2026-61639

Wallos: Zip Slip path traversal in database restore writes files to webroot

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:44:05.909Z. Updated 2026-09-01T14:39:58.852Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:39 WIB

Official record

HighPublished 01 Sep 2026, 03:41 WIB

CVE-2026-61638

Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:41:04.513Z. Updated 2026-09-01T13:50:31.633Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:50 WIB

Official record

HighPublished 01 Sep 2026, 03:38 WIB

CVE-2026-81892

EasyAdmin custom-action dispatcher bypasses access_control on other routes

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query para…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:38:06.196Z. Updated 2026-09-03T17:59:17.173Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated04 Sep 2026, 00:59 WIB

Official record

HighPublished 01 Sep 2026, 03:35 WIB

CVE-2026-82346

HP ImageDiags - Potential Escalation of Privilege

A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:35:39.046Z. Updated 2026-08-31T20:53:49.878Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 03:53 WIB

Official record

HighPublished 01 Sep 2026, 03:33 WIB

CVE-2026-81891

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:33:22.283Z. Updated 2026-09-01T14:58:22.211Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:58 WIB

Official record

HighPublished 01 Sep 2026, 03:32 WIB

CVE-2026-54600

Wallos: Unauthenticated database replacement via import endpoint on fresh install

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in versi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:32:58.226Z. Updated 2026-09-02T17:32:40.347Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated03 Sep 2026, 00:32 WIB

Official record

HighPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82229

WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:56.269Z. Updated 2026-09-01T14:40:29.193Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:40 WIB

Official record

HighPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82228

WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability

Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:55.611Z. Updated 2026-09-01T18:08:35.434Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 01:08 WIB

Official record

HighPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82225

WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:54.290Z. Updated 2026-09-01T14:58:28.324Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:58 WIB

Official record

HighPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82224

WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:53.635Z. Updated 2026-09-02T17:31:27.827Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated03 Sep 2026, 00:31 WIB

Official record