Known Exploited Vulnerabilities (KEV)
ndaal KEV
| ID | Title | Severity | CVSS | EPSS | Source | Updated |
|---|---|---|---|---|---|---|
| cve-2026-35290 | PUBLISHED | CRITICAL | 9.8 | 0.51% | cvelistv5 | 2026-07-23 |
| cve-2026-35287 | PUBLISHED | HIGH | 7.5 | 0.41% | cvelistv5 | 2026-07-23 |
| cve-2026-35204 | SUSE CVE CVE-2026-35204 | HIGH | 8.4 | 0.19% | cvelistv5 | 2026-08-31 |
| cve-2026-3505 | Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of th... | HIGH | 8.7 | 0.88% | cvelistv5 | 2026-09-18 |
| cve-2026-34757 | SUSE CVE CVE-2026-34757 | MEDIUM | 5.1 | 0.16% | cvelistv5 | 2026-09-16 |
| cve-2026-34520 | SUSE CVE CVE-2026-34520 | MEDIUM | 5.3 | 0.68% | cvelistv5 | 2026-08-31 |
| cve-2026-34500 | SUSE CVE CVE-2026-34500 | MEDIUM | 4.8 | 0.60% | cvelistv5 | 2026-08-31 |
| cve-2026-34487 | Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files | MEDIUM | 6.5 | 0.62% | cvelistv5 | 2026-07-15 |
| cve-2026-34481 | org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output | MEDIUM | 6.5 | 0.85% | cvelistv5 | 2026-09-04 |
| cve-2026-34480 | SUSE CVE CVE-2026-34480 | MEDIUM | 6.5 | 1.19% | cvelistv5 | 2026-06-26 |
| cve-2026-34478 | SUSE CVE CVE-2026-34478 | UNKNOWN | N/A | 1.19% | cvelistv5 | 2026-04-14 |
| cve-2026-34316 | PUBLISHED | MEDIUM | 6.1 | 0.24% | cvelistv5 | 2026-07-23 |
| cve-2026-33871 | SUSE CVE CVE-2026-33871 | MEDIUM | 5.9 | 1.20% | cvelistv5 | 2026-09-15 |
| cve-2026-33557 | kafka: Apache Kafka: Authentication bypass via improper JWT validation | HIGH | 8.6 | 0.93% | cvelistv5 | 2026-06-30 |
| cve-2026-30922 | pyasn1 is a generic ASN.1 library for Python | HIGH | 7.5 | 0.93% | cvelistv5 | 2026-09-10 |
| cve-2026-29167 | SUSE CVE CVE-2026-29167 | MEDIUM | 5.3 | 0.95% | cvelistv5 | 2026-09-11 |
| cve-2026-29062 | jackson-core: jackson-core: Denial of Service via excessive JSON nesting | HIGH | 7.5 | 0.76% | cvelistv5 | 2026-06-30 |
| cve-2026-28387 | SUSE CVE CVE-2026-28387 | MEDIUM | 6.5 | 0.94% | cvelistv5 | 2026-09-16 |
| cve-2026-27727 | SUSE CVE CVE-2026-27727 | CRITICAL | 9.8 | 1.58% | cvelistv5 | 2026-07-01 |
| cve-2026-27601 | Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions | MEDIUM | 5.9 | 0.99% | cvelistv5 | 2026-07-02 |
| cve-2026-27205 | SUSE CVE CVE-2026-27205 | MEDIUM | 6.5 | 0.42% | cvelistv5 | 2026-07-15 |
| cve-2026-27141 | golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames | MEDIUM | 5.3 | 0.65% | cvelistv5 | 2026-08-25 |
| cve-2026-27135 | SUSE CVE CVE-2026-27135 | HIGH | 7.5 | 0.89% | cvelistv5 | 2026-09-21 |
| cve-2026-27099 | org.jenkins-ci.main/jenkins-core: Jenkins: Stored Cross-site Scripting (XSS) via unescaped user-provided offline cause description | MEDIUM | 4.6 | 0.57% | cvelistv5 | 2026-09-04 |
| cve-2026-26960 | SUSE CVE CVE-2026-26960 | UNKNOWN | N/A | 0.20% | cvelistv5 | 2026-03-13 |
| cve-2026-26007 | SUSE CVE CVE-2026-26007 | MEDIUM | 5.9 | 0.34% | cvelistv5 | 2026-07-22 |
| cve-2026-25639 | Axios is a promise based HTTP client for the browser and Node.js | HIGH | 7.5 | 1.76% | cvelistv5 | 2026-09-10 |
| cve-2026-25526 | JinJava Bypass through ForTag leads to Arbitrary Java Execution | CRITICAL | 9.8 | 0.92% | cvelistv5 | 2026-06-17 |
| cve-2026-24734 | tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation | HIGH | 7.4 | 0.52% | cvelistv5 | 2026-07-15 |
| cve-2026-24400 | assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) | MEDIUM | 6.1 | 0.58% | cvelistv5 | 2026-08-26 |