Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 314 published records · 0 KEV · 314 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

314 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med00.00%
Low314100%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Aug 26314

Signal coverage

KEV-listed: 0
With a forecast: 314
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.00% · forecast 100% · unscored 0.00%.

Showing 1–20 of 314By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 314, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

LowPublished 01 Sep 2026, 04:15 WIB

CVE-2026-77351

Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation. When the scheduled noti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T21:15:23.590Z. Updated 2026-09-01T13:29:07.182Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:29 WIB

Official record

LowPublished 01 Sep 2026, 01:24 WIB

CVE-2023-31308

CVE-2023-31308

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read.

Excerpt language: en.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:24:10.786Z. Updated 2026-09-01T14:04:30.336Z.

Showing 1 to 20 of 314.Next page

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:04 WIB

Official record

LowPublished 01 Sep 2026, 01:13 WIB

CVE-2026-14367

I3C IBI work-node free-list data race between ISR and workqueue thread

The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization. The allocation helpers (i3c_ibi_work_enqueue, i3c_ibi_work_enqueue_target_irq, i3c_ibi_work_enqueue_hotjoin, i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:13:15.626Z. Updated 2026-09-01T14:05:04.912Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:05 WIB

Official record

LowPublished 31 Aug 2026, 22:48 WIB

CVE-2026-21827

HCL Connections is vulnerable to an information disclosure vulnerability

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:48:17.026Z. Updated 2026-09-01T14:47:00.025Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:47 WIB

Official record

LowPublished 31 Aug 2026, 15:46 WIB

CVE-2026-82865

pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the Designer and select a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T08:46:35.945Z. Updated 2026-10-08T15:25:39.921Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:25 WIB

Official record

LowPublished 31 Aug 2026, 14:45 WIB

CVE-2026-82631

valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T07:45:13.359Z. Updated 2026-08-31T11:33:30.966Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 18:33 WIB

Official record

LowPublished 31 Aug 2026, 10:09 WIB

CVE-2026-82725

AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data. AshPhoenix.FilterForm resolved eve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T03:09:25.850Z. Updated 2026-08-31T15:49:46.161Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:49 WIB

Official record

LowPublished 31 Aug 2026, 10:03 WIB

CVE-2026-82727

AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Auto builds a union sub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T03:03:58.982Z. Updated 2026-08-31T14:49:25.154Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:49 WIB

Official record

LowPublished 31 Aug 2026, 09:31 WIB

CVE-2026-81853

AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T02:31:29.547Z. Updated 2026-08-31T15:58:40.226Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:58 WIB

Official record

LowPublished 31 Aug 2026, 09:29 WIB

CVE-2026-81852

AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T02:29:14.304Z. Updated 2026-08-31T15:59:44.933Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:59 WIB

Official record

LowPublished 31 Aug 2026, 09:26 WIB

CVE-2026-82681

Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T02:26:05.357Z. Updated 2026-08-31T16:01:32.019Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:01 WIB

Official record

LowPublished 31 Aug 2026, 06:30 WIB

CVE-2026-82594

LogNet grpc-spring-boot-starter Annotation Processing improper authorization

A vulnerability has been found in LogNet grpc-spring-boot-starter up to 5.2.0. Affected is an unknown function of the component Annotation Processing. Such manipulation leads to improper authorization. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T23:30:10.148Z. Updated 2026-08-31T16:14:49.507Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:14 WIB

Official record

LowPublished 31 Aug 2026, 01:20 WIB

CVE-2026-81643

Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, do_send/5 resolves the first notification of a batch and filters it with should_send?/1, which drops results whose errors are co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T18:20:35.564Z. Updated 2026-08-31T15:01:05.884Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:01 WIB

Official record

LowPublished 31 Aug 2026, 01:17 WIB

CVE-2026-82367

Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch from the process dictionary via Process.get(:batch_resolved) and then unconditionally …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T18:17:13.538Z. Updated 2026-09-01T15:37:34.054Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 22:37 WIB

Official record

LowPublished 31 Aug 2026, 01:06 WIB

CVE-2026-81322

Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts. AshCloak.Transformers.SetUpEncryption removes ea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T18:06:33.478Z. Updated 2026-09-01T12:34:57.167Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 19:34 WIB

Official record

LowPublished 30 Aug 2026, 21:33 WIB

CVE-2026-82656

Admidio before 5.0.12 Path Traversal via Photo ZIP Download

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended dire…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T14:33:36.502Z. Updated 2026-08-31T18:52:19.022Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:52 WIB

Official record

LowPublished 30 Aug 2026, 18:59 WIB

CVE-2026-81316

Same-named aggregates with differing filters are conflated in AshSql

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.different_queries?/2 reports two aggregate querie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T11:59:41.945Z. Updated 2026-08-31T14:59:22.223Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:59 WIB

Official record

LowPublished 30 Aug 2026, 18:56 WIB

CVE-2026-81318

Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.add_single_aggs/5 rebuilds the outer query from query.from.s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T11:56:52.921Z. Updated 2026-08-31T16:59:41.443Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 23:59 WIB

Official record

LowPublished 30 Aug 2026, 18:55 WIB

CVE-2026-78691

Unescaped backslash allows LIKE wildcard injection in AshSql string search

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who supplies a search term to contains/2, string_starts_with/2, or string_ends_with/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled pattern match. The e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T11:55:20.331Z. Updated 2026-08-31T14:57:41.423Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:57 WIB

Official record

LowPublished 30 Aug 2026, 18:53 WIB

CVE-2026-80227

SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory (or the reverse). string_trim/1 compiles to REGEXP_REPL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-30T11:53:35.548Z. Updated 2026-08-31T14:56:51.710Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:56 WIB

Official record