Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1761–1780 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-74928

WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:20.344Z. Updated 2026-08-26T14:43:09.020Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-74851

Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the automatic default on inst…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1761 to 1780 of 12259.First page Next page

Published 2026-08-26T06:00:20.171Z. Updated 2026-08-26T14:43:09.184Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-19718

BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:19.992Z. Updated 2026-08-26T14:43:09.346Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-19226

Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:19.818Z. Updated 2026-08-26T14:43:09.512Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-19220

Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:19.642Z. Updated 2026-08-26T14:43:09.681Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-19094

Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters

The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly available. The injected tex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:19.470Z. Updated 2026-08-26T14:43:09.843Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-16986

Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:19.289Z. Updated 2026-08-26T14:43:10.015Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-16984

WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:19.071Z. Updated 2026-08-26T14:43:10.172Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-14550

WPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization

The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator moderation workflow.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:18.876Z. Updated 2026-08-26T14:43:10.333Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-14216

Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:18.648Z. Updated 2026-09-03T12:58:58.600Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Sep 2026, 19:58 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-14212

Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:18.461Z. Updated 2026-08-26T14:43:10.666Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-13406

Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:18.287Z. Updated 2026-08-26T14:36:36.786Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:36 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-13404

Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:18.118Z. Updated 2026-08-26T14:43:10.829Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 13:00 WIB

CVE-2026-13172

Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure

The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T06:00:17.901Z. Updated 2026-08-26T14:43:10.981Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:43 WIB

Official record

UnscoredPublished 26 Aug 2026, 12:39 WIB

CVE-2026-58094

TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T05:39:42.893Z. Updated 2026-08-27T03:57:03.732Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 10:57 WIB

Official record

MedPublished 26 Aug 2026, 12:37 WIB

CVE-2026-79654

Ketello: katello content view history api cross-organization authorization bypass

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T05:37:38.450Z. Updated 2026-10-02T17:36:41.175Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated03 Oct 2026, 00:36 WIB

Official record

CritPublished 26 Aug 2026, 12:36 WIB

CVE-2026-15203

Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software updat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T05:36:02.006Z. Updated 2026-08-26T14:58:01.137Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:58 WIB

Official record

UnscoredPublished 26 Aug 2026, 12:33 WIB

CVE-2026-58093

Kernel use-after-free via tty ioctls

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An unprivileged local user can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T05:33:30.605Z. Updated 2026-08-27T03:56:58.736Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 10:56 WIB

Official record

HighPublished 26 Aug 2026, 12:30 WIB

CVE-2026-19760

WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T05:30:46.756Z. Updated 2026-08-26T14:54:13.535Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:54 WIB

Official record

UnscoredPublished 26 Aug 2026, 12:28 WIB

CVE-2026-58097

ppp(8): missing length validation in mp_SetEnddisc()

mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T05:28:17.570Z. Updated 2026-08-27T03:57:12.382Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 10:57 WIB

Official record