Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1661–1680 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-86609

Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:19.713Z. Updated 2026-09-28T00:48:09.004Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-85002

EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1661 to 1680 of 14934.First page Next page

Published 2026-09-27T06:00:19.536Z. Updated 2026-09-28T00:48:09.138Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-82841

UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:19.369Z. Updated 2026-09-28T00:48:09.261Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-81655

Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:19.197Z. Updated 2026-09-28T00:48:09.402Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

UnscoredPublished 27 Sep 2026, 13:00 WIB

CVE-2026-84069

WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T06:00:19.008Z. Updated 2026-09-28T00:48:09.520Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Sep 2026, 07:48 WIB

Official record

MedPublished 27 Sep 2026, 10:30 WIB

CVE-2026-100746

coollabsio Coolify GitHub App Setup redirect missing authentication

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed remotely. The exploit has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T03:30:18.973Z. Updated 2026-09-28T13:48:00.442Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:48 WIB

Official record

MedPublished 27 Sep 2026, 09:00 WIB

CVE-2026-100745

Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T02:00:16.547Z. Updated 2026-09-28T15:57:54.488Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 22:57 WIB

Official record

MedPublished 27 Sep 2026, 08:30 WIB

CVE-2026-100837

Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching

Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffix(hostname, fqdn) without requiring a DNS label boundary, so a registry entry such as [registries."gh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:30:05.443Z. Updated 2026-09-28T13:47:25.357Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:47 WIB

Official record

MedPublished 27 Sep 2026, 08:29 WIB

CVE-2026-100836

Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded cip…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:29:58.070Z. Updated 2026-09-28T16:00:49.167Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:00 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100865

Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape

Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:53.874Z. Updated 2026-09-28T13:40:50.761Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:40 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100864

heym before 0.0.91 Remote Code Execution via Expression Engine

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to acc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:53.237Z. Updated 2026-09-28T16:04:18.805Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:04 WIB

Official record

MedPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100863

Heym before 0.0.91 SSRF via image fetching and IPv6 validation

Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91. First, the LLM image-edit input loader (_load_image_bytes) fetched caller-controlled HTTP/HTTPS URLs with a bare httpx.get, applying only a scheme check and bypassing the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:52.561Z. Updated 2026-09-30T15:24:03.334Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:24 WIB

Official record

MedPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100862

heym before 0.0.91 Multiple Secrets Plaintext Storage

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values (returned in cleartext by GET /api/workflows/{id} and persisted unsanitized into execution history), MCP API keys (stored as a plaintext colu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:51.915Z. Updated 2026-09-30T15:49:32.160Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:49 WIB

Official record

MedPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100861

heym before 0.0.105 SSRF via credential-controlled base URLs

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service responses returned as workflo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:51.256Z. Updated 2026-09-28T13:38:46.572Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 20:38 WIB

Official record

MedPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100860

heym before 0.0.105 Authentication Bypass via Redis Node

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py). When _get_accessible_credential returns None — because the credential ID does not exist or the caller is not authorized to use it — the node treats …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:50.589Z. Updated 2026-09-28T16:05:18.442Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:05 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100859

Heym before 0.0.106 Credential Exfiltration via URL Override

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted au…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:49.880Z. Updated 2026-09-30T15:23:06.521Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:23 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100858

heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes

heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials (webhook_url / flaresolverr_url) using an unguarded HTTP client, bypassing the SSRF egress guard that already protects t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:49.185Z. Updated 2026-09-30T15:41:51.178Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 22:41 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100857

AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration. Attackers can injec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:48.450Z. Updated 2026-10-08T15:22:06.208Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100856

AzuraCast before 0.23.6 Code Injection via Remote Relay Password

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:47.778Z. Updated 2026-10-08T15:22:05.345Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

HighPublished 27 Sep 2026, 08:28 WIB

CVE-2026-100855

AzuraCast before 0.23.6 Missing Permission Check via /play

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media library of stations …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-27T01:28:47.099Z. Updated 2026-10-08T15:22:04.312Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record