Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1621–1640 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 27 Oct 2026, 14:08 WIB

CVE-2026-111459

Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)

An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T07:08:17.598Z. Updated 2026-10-27T07:08:17.598Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 14:08 WIB

Official record

MedPublished 27 Oct 2026, 13:54 WIB

CVE-2026-106174

CVE-2026-106174

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1621 to 1640 of 16156.First page Next page

Published 2026-10-27T06:54:54.066Z. Updated 2026-10-27T10:13:38.390Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 17:13 WIB

Official record

MedPublished 27 Oct 2026, 13:45 WIB

CVE-2026-105946

Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt

Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an applicat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T06:45:36.400Z. Updated 2026-10-27T06:45:36.400Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 13:45 WIB

Official record

LowPublished 27 Oct 2026, 13:42 WIB

CVE-2026-103325

TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T06:42:43.940Z. Updated 2026-10-28T17:36:08.352Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:36 WIB

Official record

MedPublished 27 Oct 2026, 13:42 WIB

CVE-2026-103359

PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooC…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T06:42:43.340Z. Updated 2026-10-28T17:35:39.229Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:35 WIB

Official record

MedPublished 27 Oct 2026, 13:42 WIB

CVE-2026-110910

qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax instead of data, so a caller-supplied key name can add par…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T06:42:42.365Z. Updated 2026-10-27T19:32:36.456Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 02:32 WIB

Official record

HighPublished 27 Oct 2026, 13:40 WIB

CVE-2026-75891

Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T06:40:42.359Z. Updated 2026-10-29T01:52:00.797Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:52 WIB

Official record

UnscoredPublished 27 Oct 2026, 13:00 WIB

CVE-2026-103312

Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback

The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T06:00:20.103Z. Updated 2026-10-28T17:58:09.938Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 27 Oct 2026, 13:00 WIB

CVE-2026-103332

Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key

The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any order as paid.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T06:00:19.925Z. Updated 2026-10-28T17:58:10.127Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

MedPublished 27 Oct 2026, 12:56 WIB

CVE-2026-117472

URL prefix handling permits API key read-scope bypass in Psono Server

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T05:56:16.775Z. Updated 2026-10-27T05:56:16.775Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 12:56 WIB

Official record

MedPublished 27 Oct 2026, 12:55 WIB

CVE-2026-117471

User-controlled Duo host permits authenticated SSRF in Psono Server

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T05:55:07.068Z. Updated 2026-10-27T05:55:07.068Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 12:55 WIB

Official record

MedPublished 27 Oct 2026, 12:53 WIB

CVE-2026-117470

WebAuthn assertion replay permits second-factor bypass in Psono Server

Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge rem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T05:53:41.709Z. Updated 2026-10-27T05:53:41.709Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 12:53 WIB

Official record

MedPublished 27 Oct 2026, 12:52 WIB

CVE-2026-117469

File-transfer type confusion permits unauthorized repository writes in Psono Server

Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected obj…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T05:52:24.709Z. Updated 2026-10-27T05:52:24.709Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 12:52 WIB

Official record

MedPublished 27 Oct 2026, 12:41 WIB

CVE-2026-117468

Device-code claim permits restricted token escalation in Psono Server

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T05:41:30.742Z. Updated 2026-10-27T05:59:08.920Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 12:59 WIB

Official record

HighPublished 27 Oct 2026, 12:30 WIB

CVE-2026-111820

Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title

The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T05:30:30.909Z. Updated 2026-10-29T01:52:00.940Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:52 WIB

Official record

MedPublished 27 Oct 2026, 09:01 WIB

CVE-2026-88781

CVE-2026-88781

Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing a system crash. Refer to the 'Security Update for Multiple ASUS Motherboards' secti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T02:01:00.588Z. Updated 2026-10-27T02:01:00.588Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 09:01 WIB

Official record

MedPublished 27 Oct 2026, 08:30 WIB

CVE-2026-116640

Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting

A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5. Affected by this vulnerability is an unknown functionality of the file chat.php. Executing a manipulation of the argument ID can lead to cross site scripting. It is possib…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T01:30:24.793Z. Updated 2026-10-27T14:13:53.511Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 21:13 WIB

Official record

MedPublished 27 Oct 2026, 08:15 WIB

CVE-2026-116639

MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting

A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T01:15:24.435Z. Updated 2026-10-27T01:15:24.435Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 08:15 WIB

Official record

HighPublished 27 Oct 2026, 07:51 WIB

CVE-2026-116839

CVE-2026-116839

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T00:51:23.745Z. Updated 2026-10-29T01:52:06.475Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:52 WIB

Official record

HighPublished 27 Oct 2026, 07:48 WIB

CVE-2026-116838

CVE-2026-116838

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-27T00:48:17.932Z. Updated 2026-10-27T00:48:17.932Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Oct 2026, 07:48 WIB

Official record