Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 514 published records · 0 KEV · 505 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

514 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med00.00%
Low514100%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Oct 26514

Signal coverage

KEV-listed: 0
With a forecast: 505
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.00% · forecast 98% · unscored 0.00%.

Showing 1–20 of 514By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

LowPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119133

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:14.355Z. Updated 2026-10-29T15:58:14.355Z.

CVSS2.1v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

LowPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119130

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:12.004Z. Updated 2026-10-29T15:58:12.004Z.

CVSS2.1v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

LowPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119126

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:09.005Z. Updated 2026-10-29T15:58:09.005Z.

CVSS2.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

LowPublished 29 Oct 2026, 22:58 WIB

CVE-2026-119125

Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields

Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an object whose beforeSave trigger reverts a field, via revert(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:58:08.254Z. Updated 2026-10-29T15:58:08.254Z.

CVSS2.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:58 WIB

Official record

LowPublished 29 Oct 2026, 22:43 WIB

CVE-2026-115794

Alarm data length not validated against received frame length

P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reporte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:43:55.798Z. Updated 2026-10-29T15:43:55.798Z.

CVSS2.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:43 WIB

Official record

LowPublished 29 Oct 2026, 22:30 WIB

CVE-2026-112255

Endpoint credential minting (insecure default allow-list)

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for this is issue is to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:30:55.825Z. Updated 2026-10-29T15:30:55.825Z.

CVSS2.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:30 WIB

Official record

LowPublished 29 Oct 2026, 22:17 WIB

CVE-2026-104312

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file write on the victim's hos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:17:40.538Z. Updated 2026-10-29T15:17:40.538Z.

CVSS3.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:17 WIB

Official record

LowPublished 29 Oct 2026, 22:07 WIB

CVE-2026-93571

Path Traversal in Szafir

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. This issue was fixed in version 2.0 build 708.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T15:07:53.572Z. Updated 2026-10-29T15:07:53.572Z.

CVSS2.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 22:07 WIB

Official record

LowPublished 29 Oct 2026, 20:08 WIB

CVE-2026-119048

JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call /a/cms/chat/message, /a/c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. EPSS unavailable for this snapshot.

Published 2026-10-29T13:08:50.215Z. Updated 2026-10-29T13:08:50.215Z.

CVSS2.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:08 WIB

Official record

LowPublished 29 Oct 2026, 16:02 WIB

CVE-2026-85498

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentiall…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T09:02:35.845Z. Updated 2026-10-29T12:36:54.191Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 19:36 WIB

Official record

LowPublished 29 Oct 2026, 15:03 WIB

CVE-2026-115303

Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T08:03:46.351Z. Updated 2026-10-29T10:45:50.346Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

LowPublished 29 Oct 2026, 02:21 WIB

CVE-2026-3583

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T19:21:34.577Z. Updated 2026-10-29T02:02:14.134Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:02 WIB

Official record

LowPublished 29 Oct 2026, 01:33 WIB

CVE-2026-118258

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a te…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:33:30.672Z. Updated 2026-10-28T18:33:30.672Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:33 WIB

Official record

LowPublished 29 Oct 2026, 01:20 WIB

CVE-2026-118256

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() process…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:20:14.644Z. Updated 2026-10-28T18:20:14.644Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:20 WIB

Official record

LowPublished 29 Oct 2026, 00:31 WIB

CVE-2026-105615

PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats

PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:31:46.771Z. Updated 2026-10-28T17:31:46.771Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:31 WIB

Official record

LowPublished 29 Oct 2026, 00:31 WIB

CVE-2026-105612

PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles

PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T17:31:44.639Z. Updated 2026-10-28T17:31:44.639Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:31 WIB

Official record

LowPublished 28 Oct 2026, 23:50 WIB

CVE-2026-118608

Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability

Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:50:34.964Z. Updated 2026-10-28T16:50:34.964Z.

CVSS3.5v3.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:50 WIB

Official record

LowPublished 28 Oct 2026, 23:34 WIB

CVE-2026-103394

Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.

An Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to decrypt traffic or cause a denial of service via security policy assignment.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T16:34:16.486Z. Updated 2026-10-29T01:52:03.984Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:52 WIB

Official record

LowPublished 28 Oct 2026, 19:37 WIB

CVE-2026-21830

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T12:37:35.527Z. Updated 2026-10-28T12:37:35.527Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 19:37 WIB

Official record

LowPublished 28 Oct 2026, 17:33 WIB

CVE-2026-101272

Incorrect session validation for API-created shredder exports

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly genera…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T10:33:31.936Z. Updated 2026-10-28T10:33:31.936Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 17:33 WIB

Official record

Showing 1 to 20 of 514.Next page