Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1641–1660 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 27 Sep 2026, 16:07 WIB

CVE-2026-93302

Trusted peer certificate match ignores public key, allowing forged CA clones

MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The peer must know the certificates being loaded to either of th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T09:07:35.999Z. Updated 2026-09-29T16:41:22.187Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:41 WIB

Official record

MedPublished 27 Sep 2026, 16:05 WIB

CVE-2026-93304

(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known (deterministic) key and checks the server's Finished against that same key. An out-of-order ChangeCipherSpec can ther…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1641 to 1660 of 14934.First page Next page

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T09:05:37.132Z. Updated 2026-09-29T16:43:16.572Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:43 WIB

Official record

LowPublished 27 Sep 2026, 16:00 WIB

CVE-2026-94417

CRL check skipped when OCSP enabled and certificate has no OCSP URL

When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certificate the loaded CRL lists as revoked. The soft-fail policy for a missing responder…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T09:00:59.581Z. Updated 2026-09-29T17:33:10.533Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 00:33 WIB

Official record

LowPublished 27 Sep 2026, 15:58 WIB

CVE-2026-94418

Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY

Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so any parse error hid it. ParseCertRelative() reaches its validity-date, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T08:58:56.538Z. Updated 2026-09-29T16:45:58.115Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:45 WIB

Official record

LowPublished 27 Sep 2026, 15:54 WIB

CVE-2026-94419

Client session cache reference poisoning allows resumption with wrong server

Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index, hash(sessionID)} into the process-global SessionCache, and ClientSessionToSession() validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the server and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T08:54:18.510Z. Updated 2026-09-29T16:50:09.410Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 23:50 WIB

Official record

CritPublished 27 Sep 2026, 14:12 WIB

CVE-2026-100741

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a password containing a backsl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T07:12:54.503Z. Updated 2026-09-28T13:31:30.984Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:31 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-97319

PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:23.019Z. Updated 2026-09-28T00:48:07.210Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-97227

NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, dele…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:22.837Z. Updated 2026-09-28T00:48:07.339Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-96899

Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:22.661Z. Updated 2026-09-28T00:48:07.465Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-96897

Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected insta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:22.476Z. Updated 2026-09-28T00:48:07.591Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-96896

Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:22.286Z. Updated 2026-09-28T00:48:07.716Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-96895

WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:22.090Z. Updated 2026-09-28T00:48:07.841Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-92995

Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file

The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:21.844Z. Updated 2026-09-28T00:48:07.971Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-92436

Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address to confirm that the cust…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:21.636Z. Updated 2026-09-28T00:48:08.102Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-89006

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:21.446Z. Updated 2026-09-28T00:48:08.230Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-89003

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:21.263Z. Updated 2026-09-28T00:48:08.372Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-89001

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user, including an administrator…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:21.092Z. Updated 2026-09-28T00:48:08.495Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-89000

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only resources and read the respo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:20.905Z. Updated 2026-09-28T00:48:08.620Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-86841

Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:20.482Z. Updated 2026-09-28T00:48:08.749Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-86839

Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify and delete other staff …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:20.309Z. Updated 2026-09-28T00:48:08.876Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record