Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1861–1880 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-96531

Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:21.129Z. Updated 2026-09-26T22:41:13.936Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-96526

MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1861 to 1880 of 14934.First page Next page

Published 2026-09-26T06:00:20.949Z. Updated 2026-09-26T22:41:14.081Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-96525

MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflows created by administr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:20.775Z. Updated 2026-09-26T22:41:14.229Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-96524

MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator acc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:20.605Z. Updated 2026-09-26T22:41:14.369Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-92411

WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:20.432Z. Updated 2026-09-26T22:41:14.510Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-85081

Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:20.014Z. Updated 2026-09-26T22:41:14.658Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-84097

WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unaut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:19.546Z. Updated 2026-09-26T22:41:14.816Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-84096

WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:19.375Z. Updated 2026-09-26T22:41:14.959Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-84095

WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:19.203Z. Updated 2026-09-26T22:41:15.130Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-19708

File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:19.030Z. Updated 2026-09-26T22:41:15.281Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-16591

WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perfor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:18.840Z. Updated 2026-09-26T22:41:15.417Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-11871

Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details

The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the admini…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:18.667Z. Updated 2026-09-29T12:55:58.069Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2026, 19:55 WIB

Official record

UnscoredPublished 26 Sep 2026, 13:00 WIB

CVE-2026-89237

Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T06:00:18.483Z. Updated 2026-09-26T22:41:15.689Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:41 WIB

Official record

MedPublished 26 Sep 2026, 09:28 WIB

CVE-2026-15273

Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI

The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:28:02.175Z. Updated 2026-09-26T22:51:17.471Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated27 Sep 2026, 05:51 WIB

Official record

HighPublished 26 Sep 2026, 09:19 WIB

CVE-2026-100599

OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In deployments with the Googl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:19:18.983Z. Updated 2026-09-28T17:01:20.520Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:01 WIB

Official record

HighPublished 26 Sep 2026, 09:19 WIB

CVE-2026-100598

OpenClaw before 2026.7.1 Approval Binding Logic Error

OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the same conversation. As …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:19:18.296Z. Updated 2026-09-28T19:18:21.339Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 02:18 WIB

Official record

HighPublished 26 Sep 2026, 09:19 WIB

CVE-2026-100597

OpenClaw before 2026.7.1 Path Traversal via Filesystem Race

OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safety check, if the path …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:19:17.613Z. Updated 2026-09-30T00:30:35.989Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated30 Sep 2026, 07:30 WIB

Official record

HighPublished 26 Sep 2026, 09:19 WIB

CVE-2026-100596

OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host confidentiality, integri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:19:16.957Z. Updated 2026-10-05T14:55:02.332Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 21:55 WIB

Official record

HighPublished 26 Sep 2026, 09:19 WIB

CVE-2026-100595

OpenClaw before 2026.7.1 Authorization Bypass via diagnostics

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive diagnostic details about the host, configuration, runtime, and connected services intend…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:19:16.327Z. Updated 2026-09-28T17:29:06.097Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:29 WIB

Official record

HighPublished 26 Sep 2026, 09:19 WIB

CVE-2026-100594

OpenClaw before 2026.7.1 Authorization Bypass via trajectory export

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadata from affected session…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T02:19:15.641Z. Updated 2026-09-28T19:19:54.540Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 02:19 WIB

Official record