Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1841–1860 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100610

Flowise through 3.1.4 Missing Authorization via upsert-history

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory() returns UpsertHistory rows selected solely by an attacker-supplied chatflowid, and patchDelete…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:52.636Z. Updated 2026-09-28T19:07:04.058Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 02:07 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100609

Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1841 to 1860 of 14934.First page Next page

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:51.940Z. Updated 2026-09-30T12:50:05.029Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 19:50 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100608

Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode (MODE=queue, ENABLE_BULLMQ_DASHBOARD=true, and !isCloud()), the /admin/queues mount is protected only by the verifyTokenForBullMQDashboard middleware, w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:51.224Z. Updated 2026-10-05T15:57:31.978Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 22:57 WIB

Official record

CritPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100607

Flowise through 3.1.4 Authentication Bypass via Email-Only SSO

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:50.537Z. Updated 2026-09-28T17:07:58.552Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:07 WIB

Official record

CritPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100606

Flowise through 3.1.4 Authentication Bypass via SSO Email Match

Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin (SSOBase.ts:80-94) copies the user record from the database — including the server-stored single-u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:49.835Z. Updated 2026-09-28T19:10:36.679Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 02:10 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100605

Flowise through 3.1.4 Missing Authorization via Chat Message Routes

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read chat histories, prompts, m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:49.124Z. Updated 2026-09-30T12:48:59.289Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 19:48 WIB

Official record

MedPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100604

ClawHub Authentication Bypass via Former Publisher Skill Control

ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current organization privileges. An …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:48.436Z. Updated 2026-10-05T15:56:06.276Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 22:56 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100603

ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports

ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that skill from the catalog without any moderator decision. Because the reporter quota c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:47.730Z. Updated 2026-09-28T17:05:43.542Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:05 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100602

ClawHub Changelog Preview Information Disclosure via Authorization Bypass

ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read authorization enforced…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:47.020Z. Updated 2026-09-28T19:13:23.012Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 02:13 WIB

Official record

MedPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100601

ClawHub SSRF via Unchecked DNS Resolution in Profile Image

ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destinatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:46.283Z. Updated 2026-09-30T12:47:18.560Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 19:47 WIB

Official record

MedPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100600

ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API

ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests share a single default quota allowance. A remote, unauthenticated caller can drain that shared allowance and thereby deny or degrade API access for unrelated vi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:45.578Z. Updated 2026-10-05T16:06:18.571Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 23:06 WIB

Official record

MedPublished 26 Sep 2026, 19:45 WIB

CVE-2026-100315

mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The exploit is now public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T12:45:07.953Z. Updated 2026-09-30T00:35:13.609Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:35 WIB

Official record

MedPublished 26 Sep 2026, 18:30 WIB

CVE-2026-100314

mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated remotely. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T11:30:09.269Z. Updated 2026-09-28T17:03:16.657Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:03 WIB

Official record

MedPublished 26 Sep 2026, 18:15 WIB

CVE-2026-100313

mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. Executing a manipulation of the argument queryx can lead to cross site scripting. It is possible to launch the attack remotely. The expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T11:15:10.990Z. Updated 2026-09-28T19:17:01.191Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 02:17 WIB

Official record

MedPublished 26 Sep 2026, 15:45 WIB

CVE-2026-100312

mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possible to initiate the atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T08:45:11.535Z. Updated 2026-09-30T00:33:06.612Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:33 WIB

Official record

HighPublished 26 Sep 2026, 15:31 WIB

CVE-2026-98163

cgroup: Avoid iteration of dying tasks with zero refcount

In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from cgroup_task_release() to cgroup_task_free()") extended the lifetime of tasks on the dying_tasks list. The iterators have provis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T08:31:50.899Z. Updated 2026-10-19T09:14:56.823Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated19 Oct 2026, 16:14 WIB

Official record

MedPublished 26 Sep 2026, 15:00 WIB

CVE-2026-100311

mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument V_Title/V_Url/V_Remarks leads to cross site scr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T08:00:10.040Z. Updated 2026-09-28T17:02:10.205Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:02 WIB

Official record

CritPublished 26 Sep 2026, 13:39 WIB

CVE-2026-18143

Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:39:44.226Z. Updated 2026-09-26T22:51:17.345Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-96533

Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:21.471Z. Updated 2026-09-26T22:41:13.656Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-96532

Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:21.301Z. Updated 2026-09-26T22:41:13.804Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record